Guide to Computer
Forensics and
Investigations: Processing
Digital Evidence
Fifth Edition
Bill Nelson
Amelia Phillips
Christopher Steuart
Australia • Brazil • Mexico • Singapore • United Kingdom • United States
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
This is an electronic version of the print textbook. Due to electronic rights restrictions,
some third party content may be suppressed. Editorial review has deemed that any suppressed
content does not materially affect the overall learning experience. The publisher reserves the right
to remove content from this title at any time if subsequent rights restrictions require it. For
valuable information on pricing, previous editions, changes to current editions, and alternate
formats, please visit www.cengage.com/highered to search by ISBN#, author, title, or keyword for
materials in your areas of interest.
Important Notice: Media content referenced within the product description or the product
text may not be available in the eBook version.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Guide to Computer Forensics and
Investigations: Processing Digital Evidence,
Fifth Edition
Bill Nelson, Amelia Phillips,
Christopher Steuart
Product Director: Kathleen McMahon
Senior Director of Development:
Marah Bellegarde
Product Team Manager: Kristin McNary
Product Development Manager:
Leigh Hefferon
Senior Content Developer: Julia McGuirk
Developmental Editor: Lisa M. Lord
Product Assistant: Scott Finger
Marketing Director: Michele McTighe
Marketing Manager: Eric La Scola
Marketing Coordinator: Will Guiliani
ª 2016 Cengage Learning
WCN: 02-200-203
ALL RIGHTS RESERVED. No part of this work covered by the
copyright herein may be reproduced, transmitted, stored or used
in any form or by any means graphic, electronic, or mechanical,
including but not limited to photocopying, recording, scanning,
digitizing, taping, Web distribution, information networks, or
information storage and retrieval systems, except as permitted
under Section 107 or 108 of the 1976 United States Copyright Act,
without the prior written permission of the publisher.
For product information and technology assistance, contact us at
Cengage Learning Customer & Sales Support, 1-888-354-9706
For permission to use material from this text or product, submit
all requests online at cengage.com/permissions
Further permissions questions can be emailed to
permissionrequest@cengage.com
Production Director: Patty Stephan
Library of Congress Control Number: 2014958600
Senior Content Project Manager:
Brooke Greenhouse
ISBN: 978-1-285-06003-3
Managing Art Director: Jack Pendleton
Cover photo or illustration: ª Mega Pixel/
Shutterstock
Manufacturing Planner: Ron Montgomery
Compositor: Cenveo Publisher Services
Quality Assurance Tester: Serge Palladino
Cengage Learning
20 Channel Center Street
Boston, MA 02210
Cengage Learning is a leading provider of customized learning
solutions with office locations around the globe, including Singapore,
the United Kingdom, Australia, Mexico, Brazil, and Japan. Locate your
local office at: www.cengage.com/global
Cengage Learning products are represented in Canada by Nelson
Education, Ltd.
To learn more about Cengage Learning, visit www.cengage.com
Purchase any of our products at your local college store or at our
preferred online store www.cengagebrain.com.
Publisher does not warrant or guarantee any of the products described herein or perform any independent analysis in
connection with any of the product information contained herein. Publisher does not assume, and expressly disclaims,
any obligation to obtain and include information other than that provided to it by the manufacturer. The reader is
expressly warned to consider and adopt all safety precautions that might be indicated by the activities described herein
and to avoid all potential hazards. By following the instructions contained herein, the reader willingly assumes all risks
in connection with such instructions. The publisher makes no representations or warranties of any kind, including but
not limited to, the warranties of fitness for particular purpose or merchantability, nor are any such representations
implied with respect to the material set forth herein, and the publisher takes no responsibility with respect to such
material. The publisher shall not be liable for any special, consequential, or exemplary damages resulting, in whole or
part, from the readers’ use of, or reliance upon, this material.
Printed in the United States of America
Print Number: 01 Print Year: 2015
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Brief Table of Contents
PREFACE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii
CHAPTER 1
Understanding the Digital Forensics Profession and Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
CHAPTER 2
The Investigator’s Office and Laboratory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
CHAPTER 3
Data Acquisition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
CHAPTER 4
Processing Crime and Incident Scenes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
CHAPTER 5
Working with Windows and CLI Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
CHAPTER 6
Current Digital Forensics Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
CHAPTER 7
Linux and Macintosh File Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
CHAPTER 8
Recovering Graphics Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317
CHAPTER 9
Digital Forensics Analysis and Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 359
CHAPTER 10
Virtual Machine Forensics, Live Acquisitions, and Network Forensics. . . . . . . . . . . . . . . . . . . . . . . . . . . . 389
CHAPTER 11
E-mail and Social Media Investigations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423
CHAPTER 12
Mobile Device Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457
CHAPTER 13
Cloud Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481
CHAPTER 14
Report Writing for High-Tech Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511
CHAPTER 15
Expert Testimony in Digital Investigations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535
CHAPTER 16
Ethics for the Expert Witness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567
APPENDIX A
Certification Test References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599
APPENDIX B
Digital Forensics References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603
iii
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
iv
Brief Table of Contents
APPENDIX C
Digital Forensics Lab Considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609
APPENDIX D
DOS File System and Forensics Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615
GLOSSARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623
INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Table of Contents
PREFACE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii
CHAPTER 1
Understanding the Digital Forensics Profession and Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
An Overview of Digital Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Digital Forensics and Other Related Disciplines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A Brief History of Digital Forensics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding Case Law. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Developing Digital Forensics Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Preparing for Digital Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding Law Enforcement Agency Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Following Legal Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding Private-Sector Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2
4
6
8
9
10
11
12
14
Maintaining Professional Conduct . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Preparing a Digital Forensics Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
An Overview of a Computer Crime. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
An Overview of a Company Policy Violation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Taking a Systematic Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
20
20
22
22
Procedures for Private-Sector High-Tech Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Employee Termination Cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Internet Abuse Investigations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E-mail Abuse Investigations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Attorney-Client Privilege Investigations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Industrial Espionage Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Interviews and Interrogations in High-Tech Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
29
29
29
30
31
32
34
Understanding Data Recovery Workstations and Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Setting Up Your Workstation for Digital Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Conducting an Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Gathering the Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding Bit-stream Copies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Acquiring an Image of Evidence Media . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using ProDiscover Basic to Acquire a USB Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Analyzing Your Digital Evidence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Completing the Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Critiquing the Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
37
37
37
38
38
41
49
50
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
CHAPTER 2
The Investigator’s Office and Laboratory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Understanding Forensics Lab Accreditation Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Identifying Duties of the Lab Manager and Staff. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Lab Budget Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Acquiring Certification and Training. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
64
64
65
68
v
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
vi
Table of Contents
Determining the Physical Requirements for a Digital Forensics Lab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Identifying Lab Security Needs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Conducting High-Risk Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using Evidence Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Overseeing Facility Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Considering Physical Security Needs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Auditing a Digital Forensics Lab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Determining Floor Plans for Digital Forensics Labs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
70
71
71
72
73
74
74
75
Selecting a Basic Forensic Workstation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Selecting Workstations for a Lab. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Selecting Workstations for Private and Corporate Labs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Stocking Hardware Peripherals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Maintaining Operating Systems and Software Inventories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using a Disaster Recovery Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Planning for Equipment Upgrades. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
76
77
77
78
78
79
79
Building a Business Case for Developing a Forensics Lab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Preparing a Business Case for a Digital Forensics Lab. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
CHAPTER 3
Data Acquisition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Understanding Storage Formats for Digital Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Raw Format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Proprietary Formats. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Advanced Forensic Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
90
91
91
92
Determining the Best Acquisition Method. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Contingency Planning for Image Acquisitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Using Acquisition Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Mini-WinFE Boot CDs and USB Drives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Acquiring Data with a Linux Boot CD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Capturing an Image with ProDiscover Basic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Capturing an Image with AccessData FTK Imager Lite. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Validating Data Acquisitions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Linux Validation Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Windows Validation Methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
Performing RAID Data Acquisitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Understanding RAID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Acquiring RAID Disks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Using Remote Network Acquisition Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Remote Acquisition with ProDiscover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Remote Acquisition with EnCase Enterprise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Remote Acquisition with R-Tools R-Studio . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Remote Acquisition with WetStone US-LATT PRO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Remote Acquisition with F-Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
122
122
124
124
124
124
Using Other Forensics Acquisition Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
PassMark Software ImageUSB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
ASRData SMART . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Table of Contents
vii
Runtime Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
ILookIX Investigator IXimager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
SourceForge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
CHAPTER 4
Processing Crime and Incident Scenes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Identifying Digital Evidence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
Understanding Rules of Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Collecting Evidence in Private-Sector Incident Scenes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
Processing Law Enforcement Crime Scenes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Understanding Concepts and Terms Used in Warrants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Preparing for a Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Identifying the Nature of the Case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Identifying the Type of OS or Digital Device. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Determining Whether You Can Seize Computers and Digital Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Getting a Detailed Description of the Location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Determining Who Is in Charge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using Additional Technical Expertise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Determining the Tools You Need . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Preparing the Investigation Team . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
149
149
150
150
150
151
151
152
154
Securing a Computer Incident or Crime Scene. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
Seizing Digital Evidence at the Scene . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Preparing to Acquire Digital Evidence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Processing an Incident or a Crime Scene . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Processing Data Centers with RAID Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using a Technical Advisor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Documenting Evidence in the Lab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Processing and Handling Digital Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
155
155
156
159
159
160
160
Storing Digital Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
Evidence Retention and Media Storage Needs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
Documenting Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
Obtaining a Digital Hash . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Reviewing a Case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Sample Civil Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Sample Criminal Investigation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Reviewing Background Information for a Case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Planning the Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Conducting the Investigation: Acquiring Evidence with OSForensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
165
165
167
168
168
168
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
viii
Table of Contents
CHAPTER 5
Working with Windows and CLI Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Understanding File Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding the Boot Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding Disk Drives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Solid-State Storage Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
184
184
185
188
Exploring Microsoft File Structures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Disk Partitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
Examining FAT Disks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Examining NTFS Disks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
NTFS System Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
MFT and File Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
MFT Structures for File Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
NTFS Alternate Data Streams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
NTFS Compressed Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
NTFS Encrypting File System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
EFS Recovery Key Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Deleting NTFS Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Resilient File System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
197
199
200
204
213
215
216
216
217
218
Understanding Whole Disk Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Examining Microsoft BitLocker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
Examining Third-Party Disk Encryption Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
Understanding the Windows Registry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
Exploring the Organization of the Windows Registry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
Examining the Windows Registry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Understanding Microsoft Startup Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Startup in Windows 7 and Windows 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Startup in Windows NT and Later . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Understanding Virtual Machines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Creating a Virtual Machine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
CHAPTER 6
Current Digital Forensics Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
Evaluating Digital Forensics Tool Needs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Types of Digital Forensics Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Tasks Performed by Digital Forensics Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Tool Comparisons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Other Considerations for Tools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
252
253
253
263
265
Digital Forensics Software Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Command-Line Forensics Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Linux Forensics Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Other GUI Forensics Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
265
265
266
268
Digital Forensics Hardware Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Forensic Workstations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using a Write-Blocker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Recommendations for a Forensic Workstation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
268
268
269
270
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Table of Contents
ix
Validating and Testing Forensics Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Using National Institute of Standards and Technology Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Using Validation Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282
CHAPTER 7
Linux and Macintosh File Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Examining Linux File Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
File Structures in Ext4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
Understanding Macintosh File Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298
An Overview of Mac File Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299
Forensics Procedures in Mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301
Using Linux Forensics Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
Installing Sleuth Kit and Autopsy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316
CHAPTER 8
Recovering Graphics Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317
Recognizing a Graphics File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding Bitmap and Raster Images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding Vector Graphics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding Metafile Graphics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding Graphics File Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding Digital Camera File Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
318
318
319
319
319
320
Understanding Data Compression. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324
Lossless and Lossy Compression . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325
Locating and Recovering Graphics Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Identifying Graphics File Fragments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Repairing Damaged Headers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Searching for and Carving Data from Unallocated Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Rebuilding File Headers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Reconstructing File Fragments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
325
326
326
328
334
337
Identifying Unknown File Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Analyzing Graphics File Headers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Tools for Viewing Images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding Steganography in Graphics Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using Steganalysis Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
341
342
344
344
347
Understanding Copyright Issues with Graphics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
x
Table of Contents
CHAPTER 9
Digital Forensics Analysis and Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 359
Determining What Data to Collect and Analyze . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360
Approaching Digital Forensics Cases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360
Using OSForensics to Analyze Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362
Validating Forensic Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366
Validating with Hexadecimal Editors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367
Validating with Digital Forensics Tools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369
Addressing Data-Hiding Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Hiding Files by Using the OS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Hiding Partitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Marking Bad Clusters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Bit-Shifting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding Steganalysis Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Examining Encrypted Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Recovering Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
372
372
372
374
374
377
378
378
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386
CHAPTER 10
Virtual Machine Forensics, Live Acquisitions, and Network Forensics. . . . . . . . . . . . . . . . . . . . . . . . . . . . 389
An Overview of Virtual Machine Forensics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Type 2 Hypervisors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Conducting an Investigation with Type 2 Hypervisors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Working with Type 1 Hypervisors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
390
391
396
405
Performing Live Acquisitions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
Performing a Live Acquisition in Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407
Network Forensics Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
The Need for Established Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Securing a Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Developing Procedures for Network Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Examining the Honeynet Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
408
408
408
409
415
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422
CHAPTER 11
E-mail and Social Media Investigations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423
Exploring the Role of E-mail in Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424
Exploring the Roles of the Client and Server in E-mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425
Investigating E-mail Crimes and Violations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Examining E-mail Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Viewing E-mail Headers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Examining E-mail Headers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Examining Additional E-mail Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Tracing an E-mail Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using Network E-mail Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
426
427
428
430
432
432
433
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Table of Contents
xi
Understanding E-mail Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434
Examining UNIX E-mail Server Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435
Examining Microsoft E-mail Server Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436
Using Specialized E-mail Forensics Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using OSForensics to Recover E-mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using a Hex Editor to Carve E-mail Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Recovering Outlook Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E-mail Case Studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
437
439
440
443
444
Applying Digital Forensics to Social Media . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 444
Forensics Tools for Social Media Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 446
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 446
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 455
CHAPTER 12
Mobile Device Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457
Understanding Mobile Device Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458
Mobile Phone Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
Inside Mobile Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461
Understanding Acquisition Procedures for Mobile Devices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463
Mobile Forensics Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465
Mobile Forensics Tools in Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 479
CHAPTER 13
Cloud Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481
An Overview of Cloud Computing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
History of the Cloud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Cloud Service Levels and Deployment Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Cloud Vendors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Basic Concepts of Cloud Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
482
482
482
484
484
Legal Challenges in Cloud Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Service Level Agreements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Jurisdiction Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Accessing Evidence in the Cloud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
485
485
487
487
Technical Challenges in Cloud Forensics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Analysis of Cloud Forensic Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Anti-Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Incident First Responders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Role Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Standards and Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
489
490
490
490
490
491
491
Acquisitions in the Cloud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491
Encryption in the Cloud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
xii
Table of Contents
Conducting a Cloud Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Investigating CSPs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Investigating Cloud Customers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding Prefetch Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Examining Stored Cloud Data on a PC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Windows Prefetch Artifacts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
493
494
494
494
495
499
Tools for Cloud Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500
Forensic Open-Stack Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500
F-Response for the Cloud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 510
CHAPTER 14
Report Writing for High-Tech Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511
Understanding the Importance of Reports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 512
Limiting a Report to Specifics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513
Types of Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513
Guidelines for Writing Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
What to Include in Written Preliminary Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Report Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Writing Reports Clearly. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Designing the Layout and Presentation of Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
515
516
517
518
519
Generating Report Findings with Forensics Software Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523
Using ProDiscover Basic to Generate Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523
Using OSForensics to Generate Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 526
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 528
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 531
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 534
CHAPTER 15
Expert Testimony in Digital Investigations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535
Preparing for Testimony . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Documenting and Preparing Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Reviewing Your Role as a Consulting Expert or an Expert Witness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Creating and Maintaining Your CV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Preparing Technical Definitions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Preparing to Deal with the News Media . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
536
537
538
538
539
539
Testifying in Court . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding the Trial Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Providing Qualifications for Your Testimony . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
General Guidelines on Testifying. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Testifying During Direct Examination. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Testifying During Cross-Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
540
540
541
542
546
547
Preparing for a Deposition or Hearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549
Guidelines for Testifying at Depositions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549
Guidelines for Testifying at Hearings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Table of Contents
xiii
Preparing Forensics Evidence for Testimony . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551
Preparing a Defense of Your Evidence-Collection Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 554
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 556
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 559
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565
CHAPTER 16
Ethics for the Expert Witness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567
Applying Ethics and Codes to Expert Witnesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Forensics Examiners’ Roles in Testifying. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Considerations in Disqualification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Traps for Unwary Experts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Determining Admissibility of Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
568
569
570
571
572
Organizations with Codes of Ethics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
International Society of Forensic Computer Examiners. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
International High Technology Crime Investigation Association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
International Association of Computer Investigative Specialists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
American Bar Association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
American Psychological Association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
573
573
574
574
574
575
Ethical Difficulties in Expert Testimony . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 575
Ethical Responsibilities Owed to You . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 576
Standard and Personally Created Forensics Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577
An Ethics Exercise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Determining Hexadecimal Values for Text Strings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Searching for Unicode Data in ProDiscover Basic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Interpreting Attribute 0x80 Data Runs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Carving Data Run Clusters Manually . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
577
578
578
580
589
Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 593
Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 594
Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 594
Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 596
Case Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598
APPENDIX A
Certification Test References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599
APPENDIX B
Digital Forensics References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603
APPENDIX C
Digital Forensics Lab Considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609
APPENDIX D
DOS File System and Forensics Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615
GLOSSARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623
INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Preface
Preface
Guide to Computer Forensics and Investigations: Processing Digital Evidence is now in its fifth edition! My sincere congratulations to the authors and publishing staff who have made this book such a
great resource for thousands of students and practitioners worldwide. As digital technology and
cyberspace have evolved from their early roots as basic communications platforma, so has the
demand for people who have the knowledge and skills to investigate legal and technical issues involving computers and digital technology.
Today, computers, the Internet, and the world’s digital ecosystem are instrumental in how we conduct
our daily lives. The technological advancement of these systems over the past 10 years has changed the
way we learn, socialize, and conduct business. Many of us working computer forensic cases in the security and criminal justice sectors during the late 1990s came to the conclusion that technology’s rate of
growth was going to have a significant impact on our operations. Currently, the organizations and
agencies whose job it is to investigate both criminal and civil matters involving the use of rapidly evolving digital technology often struggle to keep up with the ever-changing digital landscape. Additionally,
finding trained and qualified people to conduct these types of inquiries has been challenging as well.
In 1998, while creating an instructional program for law enforcement officers, I predicted that by the
year 2005, approximately 85% of all crimes committed in the United States would have some type of
digital component related to the crime. That prediction has now come true with an entire industry
evolving for the purpose of investigating events occurring in cyberspace, including incidents involving
international and corporate espionage, massive data breaches, and even cyberterrorism. Professionals
xv
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
xvi
Preface
in this exciting field of endeavor are now in wide demand and are expected to have multiple skill sets
in areas such as malware analysis, software reverse-engineering, and mobile device forensics.
The study of computer forensics, which has subsequently morphed into the discipline digital forensics,
has become one of the hottest and in-demand career choices for many high school and college students worldwide. Guide to Computer Forensics and Investigations: Processing Digital Evidence can
now be found in both academic and professional environments as a reliable source of current technical information and practical exercises on investigations involving the latest digital technology. It’s
my belief that this book, combined with an enthusiastic and knowledgeable facilitator, will make for
a fascinating course of instruction.
As I have stated to many of my students, it’s not just desktop computers that harbor the binary code
of 1s and 0s, but an infinite array of digital devices. If one of these devices retains evidence of a crime,
it will be up to newly trained and educated digital detectives to find the evidence in a forensically
sound manner. This book will assist both students and practitioners in accomplishing this goal.
Respectfully,
John A. Sgromolo
As a Senior Special Agent, John was one of the founding members of the NCIS Computer Crime Investigations Group. John left government service to run his own company, Digital Forensics, Inc., and has
taught hundreds of law enforcement and corporate students nationwide the art and science of digital
forensic investigations. Currently, John serves as a Senior Investigator for Verizon’s RISK Team.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Introduction
Introduction
Computer forensics, now most commonly called “digital forensics,” has been a professional field for
many years, but most well-established experts in the field have been self-taught. The growth of the
Internet and the worldwide proliferation of computers have increased the need for digital investigations.
Computers can be used to commit crimes, and crimes can be recorded on computers, including
company policy violations, embezzlement, e-mail harassment, murder, leaks of proprietary information,
and even terrorism. Law enforcement, network administrators, attorneys, and private investigators now
rely on the skills of professional digital forensics experts to investigate criminal and civil cases.
This book is not intended to provide comprehensive training in digital forensics. It does, however,
give you a solid foundation by introducing digital forensics to those who are new to the field. Other
books on digital forensics are targeted to experts; this book is intended for novices who have a
thorough grounding in computer and networking basics.
The new generation of digital forensics experts needs more initial training because operating systems,
computer and mobile device hardware, and forensics software tools are changing more quickly. This
book covers current and past operating systems and a range of hardware, from basic workstations and
high-end network servers to a wide array of mobile devices. Although this book focuses on a few
forensics software tools, it also reviews and discusses other currently available tools.
The purpose of this book is to guide you toward becoming a skilled digital forensics investigator. A
secondary goal is to help you pass related certification exams. As the field of digital forensics and
investigations matures, keep in mind that certifications will change. You can find more information
on certifications in Chapter 2 and Appendix A.
xvii
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
xviii
Introduction
Intended Audience
Although this book can be used by people with a wide range of backgrounds, it’s intended for those
with A1 and Network1 certifications or the equivalent. A networking background is necessary so
that you understand how computers operate in a networked environment and can work with a
network administrator when needed. In addition, you must know how to use a computer from the
command line and how to use common operating systems, including Windows, Linux, and Mac OS,
and their related hardware.
This book can be used at any educational level, from technical high schools and community colleges to
graduate students. Current professionals in the public and private sectors can also use this book. Each group
will approach investigative problems from a different perspective, but all will benefit from the coverage.
What’s New in This Edition
The chapter flow of this book is organized so that you’re first exposed to what happens in a forensics
lab and how to set one up before you get into the nuts and bolts. Coverage of several GUI tools has
been added to give you a familiarity with some widely used software. In addition, Chapter 11 now
includes coverage of social media forensics, and Chapter 13 is a new chapter on forensics procedures
for information stored in the cloud. Chapter 12 has also expanded to include more information on
smartphones and tablets. Corrections have been made to this edition based on feedback from users,
and all software packages and Web sites have been updated to reflect what’s current at the time of
publication. Finally, a new lab manual is now offered to go with the new fifth edition textbook
(ISBN: 9781285079080).
Chapter Descriptions
Here is a summary of the topics covered in each chapter of this book:
Chapter 1, “Understanding the Digital Forensics Profession and Investigations,” introduces you to
the history of digital forensics and explains how the use of electronic evidence developed. It also
reviews legal issues and compares public and private sector cases. This chapter also explains how
to take a systematic approach to preparing a digital investigation, describes how to conduct an
investigation, and summarizes requirements for workstations and software.
Chapter 2, “The Investigator’s Office and Laboratory,” outlines physical requirements and
equipment for digital forensics labs, from small private investigators’ labs to the regional FBI lab.
It also covers certifications for digital investigators and building a business case for a forensics lab.
Chapter 3, “Data Acquisition,” explains how to prepare to acquire data from a suspect’s drive and
discusses available Linux and GUI acquisition tools. This chapter also discusses acquiring data
from RAID systems and gives you an overview of tools for remote acquisitions.
Chapter 4, “Processing Crime and Incident Scenes,” explains search warrants and the nature of a
typical digital forensics case. It discusses when to use outside professionals, how to assemble a
team, and how to evaluate a case and explains the correct procedures for searching and seizing evidence. This chapter also introduces you to calculating hashes to verify data you collect.
Chapter 5, “Working with Windows and CLI Systems,” discusses the most common operating
systems. You learn what happens and what files are altered during computer startup and how file
systems deal with deleted and slack space. In addition, this chapter covers some options for decrypting drives encrypted with whole disk encryption and explains the purpose of using virtual machines.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Introduction
xix
Chapter 6, “Current Digital Forensics Tools,” explores current digital forensics software and hardware tools, including those that might not be readily available, and evaluates their strengths and
weaknesses.
Chapter 7, “Linux and Macintosh File Systems,” continues the operating system discussion from
Chapter 5 by examining Macintosh and Linux OSs and file systems. It also gives you practice in
using Linux forensics tools.
Chapter 8, “Recovering Graphics Files,” explains how to recover graphics files and examines data
compression, carving data, reconstructing file fragments, and steganography and copyright issues.
Chapter 9, “Digital Forensics Analysis and Validation,” covers determining what data to collect
and analyze and refining investigation plans. It also explains validation with hex editors and
forensics software and data-hiding techniques.
Chapter 10, “Virtual Machine Forensics, Live Acquisitions, and Network Forensics,” covers tools
and methods for conducting forensic analysis of virtual machines, performing live acquisitions,
reviewing network logs for evidence, and using network-monitoring tools to detect unauthorized
access. It also examines using Linux tools and the Honeynet Project’s resources.
Chapter 11, “E-mail and Social Media Investigations,” examines e-mail crimes and violations and
reviews some specialized e-mail and social media forensics tools. It also explains how to approach
investigating social media communications and handling the challenges this content poses.
Chapter 12, “Mobile Device Forensics,” covers investigation techniques and acquisition
procedures for smartphones and other mobile devices. You learn where data might be stored or
backed up and what tools are available for these investigations.
Chapter 13, “Cloud Forensics,” summarizes the legal and technical challenges in conducting cloud
forensics. It also describes how to acquire cloud data and explains how remote acquisition tools
can be used in cloud investigations.
Chapter 14, “Report Writing for High-Tech Investigations,” discusses the importance of report
writing in digital forensics examinations; offers guidelines on report content, structure, and presentation; and explains how to generate report findings with forensics software tools.
Chapter 15, “Expert Testimony in Digital Investigations,” explores the role of an expert witness or
a fact witness, including developing a curriculum vitae, understanding the trial process, and preparing forensics evidence for testimony. It also offers guidelines for testifying in court and at depositions and hearings.
Chapter 16, “Ethics for the Expert Witness,” provides guidance in the principles and practice
of ethics for digital forensics investigators and examines other professional organizations’ codes of
ethics.
Appendix A, “Certification Test References,” provides information on the National Institute of
Standards and Technology (NIST) testing processes for validating digital forensics tools and covers
digital forensics certifications and training programs.
Appendix B, “Digital Forensics References,” lists recommended books, journals, e-mail lists, and
Web sites for additional information and further study. It also covers the latest ISO 27000 standards that apply to digital forensics.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
xx
Introduction
Appendix C, “Digital Forensics Lab Considerations,” provides more information on considerations for forensics labs, including certifications, ergonomics, structural design, and communication
and fire-suppression systems.
Appendix D, “DOS File System and Forensics Tools,” reviews FAT file system basics and Mac legacy file systems and explains using DOS forensics tools, creating forensic boot media, and using
scripts. It also reviews DriveSpy commands and X-Ways Replica and gives you an overview of the
hexadecimal numbering system and how it’s applied to digital information.
Features
To help you fully understand digital forensics, this book includes many features designed to enhance
your learning experience:
•
Chapter objectives—Each chapter begins with a detailed list of the concepts to be mastered
in that chapter. This list gives you a quick reference to the chapter’s contents and is a useful
study aid.
•
Figures and tables—Screenshots are used as guidelines for stepping through commands and
forensics tools. For tools not included with the book or that aren’t offered in free demo versions, figures have been added when possible to illustrate the tool’s interface. Tables are used
throughout the book to present information in an organized, easy-to-grasp manner.
•
Chapter summaries—Each chapter’s material is followed by a summary of the concepts introduced in that chapter. These summaries are a helpful way to review the ideas covered in each
chapter.
•
Key terms—Following the chapter summary, all new terms introduced in the chapter with
boldfaced text are gathered together in the Key Terms list, with full definitions for each term.
This list encourages a more thorough understanding of the chapter’s key concepts and is a
useful reference.
•
Review questions—The end-of-chapter assessment begins with a set of review questions that
reinforce the main concepts in each chapter. These questions help you evaluate and apply the
material you have learned.
•
Hands-on projects—Although understanding the theory behind digital technology is important,
nothing can improve on real-world experience. To this end, each chapter offers several hands-on
projects with software supplied with this book or free downloads. You can explore a variety of ways
to acquire and even hide evidence. For the conceptual chapters, research projects are provided.
•
Case projects—At the end of each chapter are several case projects. To complete these projects,
you must draw on real-world common sense as well as your knowledge of the technical topics
covered to that point in the book. Your goal for each project is to come up with answers to
problems similar to those you’ll face as a working digital forensics investigator.
•
Video tutorials—The Instructor Companion Site includes video tutorials to help with
learning the tools needed to perform in-chapter activities and hands-on projects. Each tutorial
is a .wmv file that can be played in most OSs.
•
Software and student data files—This book includes a DVD containing student data files and
free software demo packages for use with activities and projects in the chapters. (Additional
software demos or freeware can be downloaded to use in some projects.) Three software companies have graciously agreed to allow including their products with this book: Technology
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Introduction
xxi
Pathways (ProDiscover Basic), PassMark Software (OSForensics), and X-Ways (WinHex
Demo). To check for newer versions or additional information, visit Technology Pathways,
LLC at www.arcgroupny.com/products/, PassMark Software at www.osforensics.com, and
X-Ways Software Technology AG at www.x-ways.net.
Technology Pathways recently changed its name to the ARC
Group.
Text and Graphic Conventions
When appropriate, additional information and exercises have been added to this book to help you
better understand the topic at hand. The following icons used in this book alert you to additional
materials:
The Note icon draws your attention to additional helpful
material related to the subject being covered.
Tips based on the authors’ experience offer extra information
about how to attack a problem or what to do in real-world
situations.
The Caution icon warns you about potential mistakes or
problems and explains how to avoid them.
Each hands-on project in this book is preceded by the HandsOn icon and a description of the exercise that follows.
This icon marks case projects, which are scenario-based or
research assignments. In these extensive case examples, you’re
asked to apply independently what you have learned.
Instructor’s Resources
The following additional materials are available when this book is used in a classroom setting. All the
supplements available with this book are provided to instructors for download at our Instructor
Companion Site. Simply search for this text at login.cengage.com.
•
Electronic Instructor’s Manual—The Instructor’s Manual that accompanies this book includes
additional instructional material to assist in class preparation, including suggestions for lecture
topics, recommended lab activities, tips on setting up a lab for hands-on projects, and solutions
to all end-of-chapter materials.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
xxii
Introduction
•
Cogneroâ —Cengage Learning Testing Powered by Cognero is a flexible, online system that
allows you to author, edit, and manage test bank content from multiple Cengage Learning solutions; create multiple test versions in an instant; and deliver tests from your LMS, your classroom, or wherever you want.
•
PowerPoint presentations—This book comes with a set of Microsoft PowerPoint slides for each
chapter. These slides are meant to be used as a teaching aid for classroom presentations, to be
made available to students on the network for chapter review, or to be printed for classroom
distribution. Instructors are also at liberty to add their own slides for other topics introduced.
•
Figure files—All the figures in the book are reproduced on the Instructor Companion Site. Similar to the PowerPoint presentations, they’re included as a teaching aid for classroom presentation, to make available to students for review, or to be printed for classroom distribution.
Student Resources
Lab Manual for Guide to Computer Forensics and Investigations (ISBN: 1285079086), a
companion to Guide to Computer Forensics and Investigations, Fifth Edition, provides students with
additional hands-on experience.
Lab Requirements
The hands-on projects in this book help you apply what you have learned about digital forensics
techniques. The following sections list the minimum requirements for completing all the projects in this
book. In addition to the items listed, you must be able to download and install demo versions of software.
In Chapter 12, you use a demo version of Oxygen Forensics to
search for e-mails. This software requires getting a registration
code to download and install it, and you must e-mail the vendor
ahead of time to get this code. Make sure you allow at least a few
days to get this software ready before you start Chapter 12.
Minimum Lab Requirements
•
Lab computers that boot to Windows 7, 8, or 8.1
•
An external USB, FireWire, or SATA drive larger than a typical 512 MB USB drive
The projects in this book are designed with the following hardware and software requirements in
mind. The lab in which most of the work takes place should be a typical network training lab with a
variety of operating systems and computers available.
Operating Systems and Hardware
Windows 7, 8, or 8.1
Use a standard installation of Windows. The computer running Windows should be a fairly current
model that meets the following minimum requirements:
•
USB ports
•
CD-ROM/DVD-ROM drive
•
VGA or higher monitor
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Introduction
•
Hard disk partition of 100 GB or more
•
Mouse or other pointing device
•
Keyboard
•
At least 6 GB RAM (more is recommended)
xxiii
Linux
For this book, it’s assumed you’re using an Ubuntu standard installation, although other Linux
distributions will work with minor modifications. Also, some projects use specialized “live” Linux
distributions, such as Kali Linux.
•
Hard disk partition of 6 GB or more reserved for Linux
•
Other hardware requirements are the same as those listed for Windows computers
This book contains a DVD with data files, demo software, and
video tutorials. Some older computers and DVD drives might have
difficulty reading data from this DVD. If you have any problems,
make sure you copy the data to an external USB or FireWire drive
before transferring it to your computer.
Digital Forensics Software
Three digital forensics programs, listed previously under “Features,” are supplied with this book. In
addition, there are projects using the following software, most of which can be downloaded from the
Internet as freeware, shareware, or demo versions:
Because Web site addresses change frequently, use a search
engine to find the following software online if URLs are no longer
valid. Efforts have been made to provide information that’s
current at the time of writing, but things change constantly on the
Web. Learning how to use search tools to find what you need is a
valuable skill you’ll use as a digital forensics investigator.
•
DEFT: Download from www.deftlinux.net. This virtual appliance currently works only with
Ubuntu 12.04.
•
Device Seizure: Download from www.paraben.com.
•
Facebook Forensics: Download from www.facebookforensics.com.
•
HexWorkshop: Download from Breakpoint Software at www.hexworkshop.com.
•
IrfanView: Download from www.irfanview.com.
•
Kali Linux: Download the ISO image from www.kali.org.
•
OpenOffice (includes OpenCalc): Download from www.openoffice.org.
•
Oxygen Forensics: Register at www.oxygen-forensic.com/en/ to get a code for downloading.
You must use a business e-mail address or one ending in .edu. Oxygen doesn’t respond to free
Web-based e-mail addresses, such as Yahoo! or Gmail.
•
PsTools: Download from http://technet.microsoft.com/en-us/sysinternals/bb896649.aspx.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
xxiv
Introduction
•
SecureClean: Download from www.whitecanyon.com/ConsumerSecureClean.
•
SIMManager: Download from www.dekart.com/products/card_management/sim_manager.
•
Sleuth Kit 2.08 and Autopsy Browser 2.07 for Linux and Autopsy Browser 3.1 for Windows:
Download from www.sleuthkit.org.
•
S-Tools4: Download from http://packetstormsecurity.com/files/21688/s-tools4.zip.html or
www.4shared.com/zip/q764vcPu/s-tools4.htm.
•
VirtualBox: Download from www.virtualbox.org/wiki/Downloads.
•
Wireshark: Download from www.wireshark.org.
In addition, you use Microsoft Office Word (or other word processing software) and Excel (or other
spreadsheet software) as well as a Web browser.
About the Authors
Bill Nelson has worked for more than 30 years for two global Fortune 100 companies in information
technologies, with more than 18 years in corporate digital forensics and information security. In
addition, he has been an instructor of digital forensics classes at the City University of Seattle and the
University of Washington’s Professional and Continuing Education Department for 10 years. His
previous experience includes Automated Fingerprint Identification System (AFIS) software engineering
and reserve police work. Bill has served as president and vice president for Computer Technology
Investigators Northwest (CTIN) and is a member of Computer Related Information Management and
Education (CRIME). He routinely lectures at several colleges and universities in the Pacific Northwest.
Amelia Phillips is a graduate of the Massachusetts Institute of Technology with B.S. degrees in
astronautical engineering and archaeology and an MBA in technology management. She also holds
an interdisciplinary Ph.D. in computer security from the University of Alaska, Fairbanks. After
serving as an engineer at the Jet Propulsion Lab, she worked with e-commerce Web sites and began
her training in computer forensics to prevent credit card numbers from being stolen from sensitive
e-commerce databases. She designed certificate and AAS programs for community colleges in
e-commerce, network security, computer forensics, and data recovery. She recently designed the
Bachelor of Applied Science in cybersecurity and forensics, which was approved in 2014. She is
currently tenured at Highline College in Seattle, Washington. Amelia is a Fulbright Scholar who
taught at Polytechnic of Namibia in 2005 and 2006. She continues her work with developing nations
and travels there frequently.
Christopher K. Steuart is a practicing attorney maintaining a general litigation practice, with experience
in information systems security for a Fortune 50 company and the U.S. Army. He is also an honorary
life member and the former general counsel for Computer Investigators Northwest (CTIN). He has
presented computer forensics seminars in regional and national forums, including the American Society
for Industrial Security (ASIS), Agora, Northwest Computer Technology Crime Analysis Seminar
(NCT), and CTIN. He is currently vice president and general counsel for IT Forensics, Inc.
Acknowledgments
The team would like to express its appreciation to Product Manager Nick Lombardi, who has given
us a great deal of moral support. We would like to thank the entire editorial and production staff for
their dedication and fortitude during this project, including Julia McGuirk, Senior Content
Developer, and Brooke Greenhouse, Senior Content Project Manager. Our special thanks go to Lisa
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Introduction
xxv
Lord, the Developmental Editor. We also appreciate the careful reading and thoughtful suggestions of
the Technical Editor, Serge Palladino. We would like to thank the reviewers: Steve Bale, Truckee
Meadows Community College; Dawn Blanche, Anne Arundel Community College; Gary Kessler,
Embry-Riddle Aeronautical University; and Tenette Prevatte, Fayetteville Technical Community
College. We would also like to thank our colleagues in professional groups in Washington State and
Mike Lacey for his photos.
Bill Nelson
I want to express my appreciation to my wife, Tricia, for her support during the long hours spent
writing. I would also like to express appreciation to my coauthors along with our editors and book
reviewers for the team effort in producing this book. And special thanks for the support and
encouragement from my digital forensics colleagues: Franklin Clark, retired investigator for the Pierce
County Prosecutor’s Office, Tacoma, Washington; Detective Mike McNown, retired, Wichita PD;
Scott Larson of Larson Security, LLC; Don Allison of KoreLogic; retired detectives Brian Palmer,
Barry Walden, and Melissa Rogers of the King County Sheriff’s Office, Seattle, Washington; John
Sgromolo of Verizon; Art Ehuan of Alvarez and Marsal; Staff Sergeant Clint Baker of the RCMP;
Colin Cree of Forensic Data Recovery, Inc.; Chris Brown of Technology Pathways; Stefan
Fleischmann of X-Ways; Gordon Ross, formerly of Net Nanny; and Gordon Mitchell of Future
Focus, Inc. In addition, special thanks to colleagues Troy Larson of Microsoft, Brett Shavers, Numo
Brito, Colin Ramsden, and other unnamed contributors for the ongoing development of WinFE.
Amelia Phillips
My deepest gratitude goes to my coauthor Bill Nelson. I want to reiterate the thanks to Lisa Lord for
her patience and support and to all the people who have helped us in the past, including Teresa
Mobley, Deb Buser, and Detective Melissa Rogers. Acknowledgments go to my many past and
present students who have helped with research on what’s happening in the field of digital forensics.
Special thanks go to Jens Kircher at X-Ways, who contributed to the Macintosh and Linux chapter,
for his insight into these OSs. Thanks to my friends in Namibia, without whom I would not have
such a thorough understanding of the different laws on digital evidence and privacy, and special
thanks to Dr. Jack Bermingham, Jeff Wagnitz, Alice Madsen, and Dr. Rolita Ezeonu, who have
funded and supported me as I experienced what it means to get a Ph.D., write two textbooks, create a
bachelor’s program, and work full time. Thanks go to my friends for their support, and the most
special thanks go to my two surviving aunties, who are both great teachers and set an excellent
example for me. Without them, this would not be possible.
Christopher K. Steuart
I would like to express my appreciation to my wife, Josephine, son, Alexander, and daughter, Isobel,
for their enthusiastic support of my commitment to Guide to Computer Forensics and Investigations,
even as it consumed time and energy that they deserved. I also want to express my thanks to my
parents, William and Mary, for their support of my education and development of the skills needed
for this project. I thank my coauthors for inviting me to join them in this project. I would like to
express my appreciation to the Boy Scouts of America for providing me with the first of many
leadership opportunities in my life. I want to recognize Lieutenant General (then Captain) Edward
Soriano for seeing the potential in me as a young soldier and encouraging me in learning the skills
required to administer, communicate with, and command an organization within the structure of law,
regulation, and personal commitment. I must also thank the faculty of Drake University Law School,
particularly Professor James A. Albert, for encouraging me to think and write creatively about the
law. I also note the contribution of Diane Gagon and the staff of the Church of Scientology in Seattle,
Washington, in supporting my better understanding of commitment to myself and others.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
chapter
1
Understanding the
Digital Forensics
Profession and
Investigations
After reading this chapter and completing
the exercises, you will be able to:
• Describe the field of digital forensics
• Explain how to prepare for computer investigations and summarize
the difference between public-sector and private-sector investigations
• Explain the importance of maintaining professional conduct
• Describe how to prepare a digital forensics investigation by taking a
systematic approach
• Describe procedures for private-sector digital investigations
• Explain requirements for data recovery workstations and software
• Summarize how to conduct an investigation, including critiquing
a case
1
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
2
Chapter 1
In the past several years, the field of computer forensics has developed significantly,
including new terminology. This chapter introduces you to computer forensics or, as it’s now
typically called, digital forensics and discusses issues of importance in the industry. This book
blends traditional investigative methods with classic systems analysis problem-solving techniques and applies them to investigations involving computers and other digital media and systems. Understanding these disciplines combined with the use of the forensics tools will make
you a skilled digital forensics examiner.
This chapter also gives you an overview of how to manage a computing investigation and use
standard problem-solving techniques. You learn about the problems and challenges forensics
examiners face when preparing and processing investigations, including the ideas and questions
they must consider. To perform the activities and projects in this chapter, you work with forensic disk images from small USB drives and then can apply the same techniques to a large disk.
An Overview of Digital Forensics
As the world has become more of a level playing field, with more people online who have
access to the same information (Thomas L. Freidman, The World Is Flat, Farrar, Straus, and
Giroux, 2005), the need to standardize digital forensics processes has become more urgent.
The definition of digital forensics has also evolved over the years from simply involving securing and analyzing digital information stored on a computer for use as evidence in civil, criminal, or administrative cases. The former director of the Defense Computer Forensics
Laboratory, Ken Zatyko, wrote a treatise on the many specialties including computer forensics, network forensics, video forensics, and a host of others. He defined it as “[t]he application of computer science and investigative procedures for a legal purpose involving the
analysis of digital evidence (information of probative value that is stored or transmitted in
binary form) after proper search authority, chain of custody, validation with mathematics
(hash function), use of validated tools, repeatability, reporting and possible expert presentation” (“Commentary: Defining Digital Forensics,” Forensic Magazine, 2007).
The field of digital forensics can also encompass items such as research and incident response.
With incident response, most organizations are concerned with protecting their assets and containing the situation, not necessarily prosecuting or finding the person responsible. Research in
digital forensics also isn’t concerned with prosecution or validity of evidence. This book is
intended for digital forensics investigators and examiners at the civil, criminal, and administrative levels. Other facets of digital forensics are beyond the scope of this book. Keep in mind that
depending on the jurisdiction and situation, forensic investigators and examiners might be the
same or different personnel. In this book, the terms are used interchangeably.
For a more in-depth discussion of what the term “digital forensics”
means, see “Digital Forensic Evidence Examination” (Fred Cohen,
www.fredcohen.net/Books/2013-DFE-Examination.pdf, 2012).
Many groups have tried to create digital forensics certifications that could be recognized
worldwide but have failed in this attempt. However, they have created certifications for specific categories of practitioners, such as government investigators. Because digital evidence is
everywhere, with ubiquitous access to mobile devices, the need for a global standardized
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
An Overview of Digital Forensics
3
method is even more critical so that companies and governments can share and use digital
evidence. In October 2012, an International Organization for Standardization (ISO) standard
for digital forensics was ratified. This standard, ISO 27037 Information technology – Security
techniques – Guidelines for identification, collection, acquisition and preservation of digital
evidence, defines the personnel and methods for acquiring and preserving digital evidence. To
address the multinational cases that continue to emerge, agencies in every country should
develop policies and procedures that meet this standard.
The Federal Rules of Evidence (FRE), signed into law in 1973, was created to ensure consistency in federal proceedings, but many states’ rules map to the FRE, too. In another attempt
to standardize procedures, the FBI Computer Analysis and Response Team (CART) was
formed in 1984 to handle the increase in cases involving digital evidence. Figure 1-1 shows
the home page for the FBI CART. By the late 1990s, CART had teamed up with the Department of Defense Computer Forensics Laboratory (DCFL) for research and training. Much of
the early curriculum in this field came from the DCFL.
Figure 1-1 The FBI CART Web site
Source: www.fbi.gov/about-us/otd/image/cart-team/view
Files maintained on a computer are covered by different rules, depending on the nature of the
documents. Many court cases in state and federal courts have developed and clarified how the
rules apply to digital evidence. The Fourth Amendment to the U.S. Constitution (and each
state’s constitution) protects everyone’s right to be secure in their person, residence, and property from search and seizure. Continuing development of the jurisprudence of this amendment
has played a role in determining whether the search for digital evidence has established a different precedent, so separate search warrants might not be necessary. However, when preparing
to search for evidence in a criminal case, many investigators still include the suspect’s computer
and its components in the search warrant to avoid later admissibility problems.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
4
Chapter 1
In an important case involving these issues, the Pennsylvania Supreme Court addressed
expectations of privacy and whether evidence is admissible (see Commonwealth v. Copenhefer, 587 A.2d 1353, 526 Pa. 555 [1991]). Initial investigations by the FBI, state police, and
local police resulted in discovering computer-generated notes and instructions—some of
which had been deleted—that had been concealed in hiding places around Corry, Pennsylvania. The investigation also produced several possible suspects, including David Copenhefer,
who owned a nearby bookstore and apparently had bad relationships with the victim and
her husband. Examination of trash discarded from Copenhefer’s store revealed drafts of the
ransom note and directions. Subsequent search warrants resulted in seizure of evidence
against him. Copenhefer’s computer contained several drafts and amendments of the text of
phone calls to the victim and the victim’s husband the next day, the ransom note, the series
of hidden notes, and a plan for the entire kidnapping scheme (Copenhefer, p. 559).
On direct appeal, the Pennsylvania Supreme Court concluded that the physical evidence,
including the digital forensics evidence, was sufficient to support the bookstore owner’s conviction. Copenhefer’s argument was that “[E]ven though his computer was validly seized pursuant to a warrant, his attempted deletion of the documents in question created an
expectation of privacy protected by the Fourth Amendment. Thus, he claims, under Katz v.
United States, 389 U.S. 347, 357, 88 S.Ct. 507, 19 L.Ed.2d 576 (1967), and its progeny,
Agent Johnson’s retrieval of the documents, without first obtaining another search warrant,
was unreasonable under the Fourth Amendment and the documents thus seized should have
been suppressed” (Copenhefer, p. 561).
The Pennsylvania Supreme Court rejected this argument, stating, “A defendant’s attempt to
secrete evidence of a crime is not synonymous with a legally cognizable expectation of privacy. A mere hope for secrecy is not a legally protected expectation. If it were, search warrants would be required in a vast number of cases where warrants are clearly not necessary”
(Copenhefer, p. 562).
Every U.S. jurisdiction has case law related to the admissibility of evidence recovered from
computers and other digital devices. As you learn in this book, however, the laws on digital
evidence vary between states as well as between provinces and countries.
The U.S. Department of Justice offers a useful guide to search
and seizure procedures for computers and computer evidence at
www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf.
Digital Forensics and Other Related Disciplines
According to DIBS USA, Inc., a privately owned corporation specializing in digital forensics since
the 1990s (www.dibsforensics.com), digital forensics involves scientifically examining and analyzing data from computer storage media so that it can be used as evidence in court. In the
National Institute of Standards and Technology (NIST) document “Guide to Integrating Forensic
Techniques into Incident Response” (http://csrc.nist.gov/publications/nistpubs/800-86/SP80086.pdf, 2006), digital forensics is defined as “the application of science to the identification, collection, examination, and analysis of data while preserving the integrity of the information and
maintaining a strict chain of custody for the data.” Typically, investigating digital devices
includes collecting data securely, examining suspect data to determine details such as origin and
content, presenting digital information to courts, and applying laws to digital device practices.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
An Overview of Digital Forensics
5
In general, digital forensics is used to investigate data that can be retrieved from a computer’s
hard drive or other storage media. Like an archaeologist excavating a site, digital forensics
examiners retrieve information from a computer or its components. The information retrieved
might already be on the drive, but it might not be easy to find or decipher. On the other hand,
network forensics yields information about how attackers gain access to a network along with
files they might have copied, examined, or tampered with. Network forensics examiners use log
files to determine when users logged on and determine which URLs users accessed, how they
logged on to the network, and from what location. Network forensics also tries to determine
what tracks or new files were left behind on a victim’s computer and what changes were made.
In Chapter 10, you explore when and how network forensics should be used in an investigation.
Digital forensics is also different from data recovery, which involves retrieving information
that was deleted by mistake or lost during a power surge or server crash, for example. In data
recovery, typically you know what you’re looking for. Digital forensics is the task of recovering data that users have hidden or deleted, with the goal of ensuring that the recovered data
is valid so that it can be used as evidence. In this regard, digital forensics differs from other
types of evidence recovered from a scene. When investigators in a crime scene unit retrieve
blood or hair or bullets, they can identify what it is. When a laptop, smartphone, or other
digital device is retrieved, its contents are unknown and pose a challenge to the examiner.
The evidence can be inculpatory evidence (in criminal cases, the expression is “incriminating”)
or exculpatory evidence, meaning it tends to clear the suspect. Examiners often approach a
digital device not knowing whether it contains evidence. They must search storage media and
piece together any data they find. Forensics software tools can be used for most cases. In
extreme cases, examiners can use electron microscopes and other sophisticated equipment to
retrieve information from machines that have been damaged or reformatted purposefully. This
method is usually cost prohibitive, so it’s not normally used.
Forensics investigators often work as part of a team to secure an organization’s computers
and networks. The digital investigation function can be viewed as part of a triad that makes
up computing security. Rapid progress in technology has resulted in an expansion of the
skills needed and varies depending on the organization using practitioners in this field. Figure
1-2 shows the investigations triad made up of these functions:
•
Vulnerability/threat assessment and risk management
•
Network intrusion detection and incident response
•
Digital investigations
Each side of the triad in Figure 1-2 represents a group or department responsible for performing the associated tasks. Although each function operates independently, all three groups
draw from one another when a large-scale computing investigation is being conducted. By
combining these three groups into a team, all aspects of a digital technology investigation can
be addressed without calling in outside specialists. In smaller companies, one group might
perform all the tasks shown in the investigations triad, or a small company might contract
with service providers to perform these tasks.
When you work in the vulnerability/threat assessment and risk management group, you test
and verify the integrity of stand-alone workstations and network servers. This integrity check
covers the physical security of systems and the security of operating systems (OSs) and applications. People working in this group (often known as penetration testers) test for vulnerabilities of OSs and applications used in the network and conduct authorized attacks on the
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
Chapter 1
on
cti
ete se
n D on
sio sp
ru Re
nt ent
kI
or cid
tw In
N e and
Vu
lne
rab
ilit
Ris y/Th
k M rea
an t A
ag sse
em ss
en me
nt
t
an
d
6
Digital Investigations
Figure 1-2 The investigations triad
ª 2016 Cengage Learningâ
network to assess vulnerabilities. Typically, people performing this task have several years of
experience in system administration. Their job is to poke holes in the network to help an organization be better prepared for a real attack.
Professionals in the vulnerability assessment and risk management group also need skills in
network intrusion detection and incident response. This group detects intruder attacks by
using automated tools and monitoring network firewall logs. When an external attack is
detected, the response team tracks, locates, and identifies the intrusion method and denies
further access to the network. If an intruder launches an attack that causes damage or potential damage, this team collects the necessary evidence, which can be used for civil or criminal
litigation against the intruder and to prevent future intrusions. If an internal user is engaged
in illegal acts or policy violations, the network intrusion detection and incident response
group might assist in locating the user. For example, someone at a community college sends
e-mails containing a worm to other users on the network. The network team realizes the
e-mails are coming from a node on the internal network, and the security team focuses on
that node. The digital investigations group manages investigations and conducts forensics
analysis of systems suspected of containing evidence related to an incident or a crime. For
complex casework, this group draws on resources from personnel in vulnerability assessment,
risk management, and network intrusion detection and incident response. However, the
digital investigations group typically resolves or terminates case investigations.
A Brief History of Digital Forensics
Forty years ago, few people imagined that computers would be an integral part of everyday life.
Now computer technology is commonplace, as are crimes in which a computer is the instrument
of the crime, the target of the crime, and, by its nature, the location where evidence is stored.
By the 1970s, electronic crimes were increasing, especially in the financial sector. Most computers in that era were mainframes, used by trained people with specialized skills who
worked in finance, engineering, and academia. White-collar fraud began when people in these
industries saw a way to make money by manipulating computer data. One of the most wellknown crimes of the mainframe era is the one-half cent crime. Banks commonly tracked money
in accounts to the third decimal place or more. They used and still use the rounding-up
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
An Overview of Digital Forensics
7
accounting method when paying interest. If the interest applied to an account resulted in a fraction of a cent, that fraction was used in the calculation for the next account until the total
resulted in a whole cent. It was assumed that eventually every customer would benefit from this
averaging. Some computer programmers corrupted this method by opening an account for
themselves and writing programs that diverted all the fractional monies into their accounts. In
small banks, this practice amounted to only a few hundred dollars a month. In large banks
with millions of accounts, however, the amount could reach hundreds of thousands of dollars.
During this time, most law enforcement officers didn’t know enough about computers to ask
the right questions or to preserve evidence for trial. Many began to attend the Federal Law
Enforcement Training Center (FLETC) programs designed to train law enforcement in handling digital data.
As PCs gained popularity and began to replace mainframe computers in the 1980s, many different OSs emerged. Apple released the Apple IIe in 1983 and then the Macintosh in 1984.
Computers such as the TRS-80 and Commodore 64 were the machines of the day. CP/M
machines, such as the Kaypro and Zenith, were also in demand.
Disk Operating System (DOS) was available in many varieties, including PC-DOS, QDOS,
DR-DOS, IBM-DOS, and MS-DOS. Forensics tools at that time were simple, and most were
generated by government agencies, such as the Royal Canadian Mounted Police (RCMP,
which had its own investigative tools) and the U.S. Internal Revenue Service (IRS). Most tools
were written in C and assembly language and weren’t available to the general public.
In the mid-1980s, a new tool, Xtree Gold, appeared on the market. It recognized file types
and retrieved lost or deleted files. Norton DiskEdit soon followed and became the preferred
tool for finding and recovering deleted files. You could use these tools on the most powerful
PCs of that time; IBM-compatible computers had hard disks of 10 to 40 MB and two floppy
drives, as shown in Figure 1-3.
Figure 1-3 An 8088 computer
ª iStockPhoto.com/Maxiphoto
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
8
Chapter 1
In 1987, Apple produced the Mac SE, a Macintosh with an external EasyDrive hard disk
with 60 MB of storage (see Figure 1-4). At this time, the popular Commodore 64 still used
standard audiotapes to record data, so the Mac SE represented an important advance in computer technology.
Figure 1-4 A Mac SE with an external EasyDrive hard disk
ª Cengage Learningâ
By the early 1990s, specialized tools for digital forensics were available. The International
Association of Computer Investigative Specialists (IACIS) introduced training on software for
digital forensics examinations, and the IRS created search-warrant programs. However, no
commercial GUI software for digital forensics was available until ASR Data created Expert
Witness for Macintosh. This software could recover deleted files and fragments of deleted
files. One of the ASR Data partners later left and developed EnCase, which became a popular
digital forensics tool.
As computer technology continued to evolve, more digital forensics software was developed.
The introduction of large hard disks posed new problems for investigators. Most DOS-based
software didn’t recognize a hard disk larger than 8 GB. Because contemporary computers
have hard disks of 500 GB and often much larger, changes in forensics software were needed.
Later in this book, you explore the challenges of examining older software and hardware.
Other tools, such as ILook, which is currently maintained by the IRS Criminal Investigation
Division and limited to law enforcement, can analyze and read special files that are copies of
a disk. AccessData Forensic Toolkit (FTK) has become a popular commercial product that
performs similar tasks in the law enforcement and civilian markets.
As software companies become savvier about digital forensics and investigations, they are
producing more forensics tools to keep pace with technology. This book describes several
tools but by no means all available tools. You should refer to trade publications, e-zines, and
Web sites to stay current.
Understanding Case Law
Existing laws and statutes simply can’t keep up with the rate of technological change. Therefore, when statutes or regulations don’t exist, case law is used. In common law nations, such
as the United States, case law allows legal counsel to apply previous similar cases to current
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
An Overview of Digital Forensics
9
ones in an effort to address ambiguity in laws. Examiners must be familiar with recent court
rulings on search and seizure in the electronic environment to avoid mistakes such as exceeding a search warrant’s authority. Recent events involving privacy incursions by government
agencies have resulted in new laws and policies. Developments in technology have changed
how everyday events are viewed. For example, what should be considered private conversations? Which devices are actually protected?
Although law enforcement can certainly confiscate anything an arrested person is carrying
and log that a device, such as a smartphone, was on the person, they don’t necessarily have
the right or authority to search the device. These actions are being challenged in courts constantly. Remaining vigilant in keeping up with changing case law is critical to being an effective digital forensics investigator.
Developing Digital Forensics Resources
To be a successful digital forensics investigator, you must be familiar with more than one computing platform. In addition to older platforms, such as DOS, Windows 9x, and Windows XP,
you should be familiar with Linux, Macintosh, and current Windows platforms. However, no
one can be an expert in every aspect of computing. Likewise, you can’t know everything about
the technology you’re investigating. To supplement your knowledge, you should develop and
maintain contact with computing, network, and investigative professionals.
Join computer user groups in both the public and private sectors. In the Pacific Northwest, for
example, Computer Technology Investigators Network (CTIN) meets to discuss problems that
digital forensics examiners encounter. This nonprofit organization also conducts training.
IACIS is an excellent group for law enforcement personnel but doesn’t have local chapters.
However, groups such as the High Technology Crime Investigation Association, International
Information Systems Security Certification Consortium (ISC2), and InfraGard have local chapters open to professionals in most major cities. Build your own network of digital forensics
experts, and keep in touch through e-mail. Cultivate professional relationships with people
who specialize in technical areas different from your own specialty. If you’re a Windows
expert, for example, maintain contact with experts in Linux, UNIX, and Macintosh. If you’re
using social media to interact with experts, exercise caution and good judgment when communicating with people you haven’t met in person or whose backgrounds you don’t know.
User groups can be especially helpful when you need information about obscure OSs. For
example, a user group helped convict a child molester in Pierce County, Washington, in
1996. The suspect installed video cameras throughout his house, served alcohol to young
women to intoxicate them, and secretly filmed them playing strip poker. When he was
accused of molesting a child, police seized his computers and other physical evidence. The investigator discovered that the computers used CoCo DOS, an OS that had been out of use
for years. The investigator contacted a local user group, which supplied the standard commands and other information needed to access the system. On the suspect’s computer, the
investigator found a diary detailing the suspect’s actions over 15 years, including the molestation of more than 400 young women. As a result, the suspect received a longer sentence than
if he had been convicted of molesting only one child.
Outside experts can also give you detailed information you need to retrieve digital evidence.
For example, a recent murder case involved a husband and wife who owned a Macintosh
store. When the wife was discovered dead, apparently murdered, investigators found that she
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
10
Chapter 1
had wanted to leave her husband but didn’t because of her religious beliefs. The police got a
search warrant and confiscated the home and office computers. When the detective on the
case examined the home system, he found that the hard drive had been compressed and
erased. He contacted a Macintosh engineer, who determined the two software programs used
to compress the drive. With this knowledge, the detective could retrieve information from the
hard drive, including text files indicating that the husband spent $35,000 in business funds to
purchase cocaine and prostitution services. This evidence proved crucial in making it possible
to convict the husband of murder.
Preparing for Digital Investigations
Digital investigations can be categorized several ways. For the purposes of this discussion,
however, they fall into two categories: public-sector investigations and private-sector investigations (see Figure 1-5).
Figure 1-5 Public-sector and private-sector investigations
ª Cengage Learningâ
In general, public-sector investigations involve government agencies responsible for criminal
investigations and prosecution. Government agencies range from municipal, county, and
state or provincial police departments to federal law enforcement agencies. These
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Preparing for Digital Investigations
11
organizations must observe legal guidelines of their jurisdictions, such as Article 8 in the
Charter of Rights of Canada and the Fourth Amendment to the U.S. Constitution restricting
government search and seizure (see Figure 1-6). The law of search and seizure in the United
States protects the rights of people, including people suspected of crimes; as a digital forensics
examiner, you must follow these laws. The Department of Justice (DOJ) updates information
on computer search and seizure regularly.
Figure 1-6 The Fourth Amendment
ª Cengage Learningâ
Private-sector investigations focus more on policy violations, such as not adhering to Health
Insurance Portability and Accountability Act of 1996 (HIPAA) regulations. However, criminal acts, such as corporate espionage, can also occur. So although private-sector investigations often start as civil cases, they can develop into criminal cases; likewise, a criminal case
can have implications leading to a civil case. If you follow good forensics procedures, the evidence found in your examinations can make the transition between civil and criminal cases.
Understanding Law Enforcement Agency Investigations
When conducting public-sector investigations, you must understand laws on computerrelated crimes, including standard legal processes, guidelines on search and seizure, and how
to build a criminal case. In a criminal case, a suspect is charged with a criminal offense, such
as burglary, murder, molestation, or fraud. To determine whether there was a computer
crime, an investigator asks questions such as the following: What was the tool used to commit the crime? Was it a simple trespass? Was it a theft or vandalism? Did the perpetrator
infringe on someone else’s rights by cyberstalking or e-mail harassment?
Laws, including procedural rules, vary by jurisdiction. Therefore, this
book points out when items accepted in U.S. courts don’t stand up in
other courts. Lately, a major issue has been that European Union (EU)
privacy laws are more stringent than U.S. privacy laws. Issues related
to international companies are still being defined. Over the past few
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
12
Chapter 1
decades, more companies have been consolidating into global entities.
As a result, internal company investigations can involve laws of multiple
countries. For example, a company has a subsidiary operating in
Australia. An employee at that subsidiary is suspected of fraud, and as
part of your investigation, you need to seize his cell phone. Under U.S.
law, you can if he used it on company property and synchronized it
with the company network. Under Australian law, you can’t.
Computers and networks might be only tools used to commit crimes and are, therefore, analogous to the lockpick a burglar uses to break into a house. For this reason, many states have
added specific language to criminal codes to define crimes involving computers. States such as
Alabama have wording such as “willfully or without authorization” and specify what dollar
amount qualifies as a misdemeanor or a felony. For example, they have expanded the definition
of laws for crimes such as theft to include taking data from a computer without the owner’s permission, so computer theft is now on a par with shoplifting or car theft. States have also enacted
specific criminal statutes that address computer-related crimes but typically don’t include digital
issues in standard trespass, theft, vandalism, or burglary laws. The Computer Fraud and Abuse
Act was passed in 1986, but specific state laws were generally developed later.
For information on how each state defines and addresses computerrelated crimes, see http://statelaws.findlaw.com/criminal-laws/computercrimes/.
Many serious crimes involve computers, smartphones, and other digital devices. The most
notorious are those involving sexual exploitation of minors. Digital images are stored on
hard disks, flash drives, removable hard drives, and the cloud and are circulated on the Internet. Other computer crimes concern missing children and adults because information about
missing people is often found on computers. Drug dealers, car theft rings, and other criminals
often keep information about transactions on their computers, laptops, smartphones, and
other devices.
Following Legal Processes
When conducting a computer investigation for potential criminal violations of the law, the
legal processes you follow depend on local custom, legislative standards, and rules of evidence. In general, however, a criminal case follows three stages: the complaint, the investigation, and the prosecution. Someone files a complaint, and then a specialist investigates the
complaint and, with the help of a prosecutor, collects evidence and builds a case. If the evidence is sufficient, the case might proceed to trial.
A criminal investigation generally begins when someone finds evidence of or witnesses an illegal act. The witness or victim makes an allegation to the police, an accusation of fact that a
crime has been committed.
A police officer interviews the complainant and writes a report about the crime. The law
enforcement agency processes the report, and management decides to start an investigation
or log the information into a police blotter, which provides a record of information about
crimes that have been committed previously. Criminals often repeat actions in their illegal
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Preparing for Digital Investigations
13
activities, and these patterns can be discovered by examining police blotters. This historical
knowledge is useful when conducting investigations, especially in high-technology crimes.
Blotters now are generally electronic files, often structured as databases, so they can be
searched more easily than the old paper blotters.
To see an example of a police blotter, go to http://spdblotter.seattle.gov.
Not every police officer is a computer expert. Some are computer novices; others might be trained
to recognize what they can retrieve from a computer disk. To differentiate the training and experience officers have, ISO standard 27037 (www.iso.org/iso/catalogue detail?csnumber¼44381)
defines two categories. A Digital Evidence First Responder (DEFR) has the skill and training to
arrive on an incident scene, assess the situation, and take precautions to acquire and preserve
evidence. A Digital Evidence Specialist (DES) has the skill to analyze the data and determine
when another specialist should be called in to assist with the analysis.
If you’re an examiner assigned to a case, recognize the level of expertise of police officers and
others involved in the case. You should have DES training to conduct the examination of systems and manage the digital forensics aspects of the case. You start by assessing the scope of
the case, which includes the computer’s OS, hardware, and peripheral devices. You then
determine whether resources are available to process all the evidence. Determine whether you
have the right tools to collect and analyze evidence and whether you need to call on other
specialists to assist in collecting and processing evidence. After you have gathered the resources you need, your role is to delegate, collect, and process the information related to the complaint. After you build a case, the information is turned over to the prosecutor. As an
investigator, you must then present the collected evidence with a report to the government’s
attorney. Depending on the community and the nature of the crime, the prosecutor’s title
varies by jurisdiction.
In a criminal or public-sector case, if the police officer or investigator has sufficient cause to
support a search warrant, the prosecuting attorney might direct him or her to submit an affidavit (also called a “declaration”). This sworn statement of support of facts about or evidence of a crime is submitted to a judge with the request for a search warrant before seizing
evidence. Figure 1-7 shows a typical affidavit. It’s your responsibility to write the affidavit,
which must include exhibits (evidence) that support the allegation to justify the warrant. You
must then have the affidavit notarized under sworn oath to verify that the information in the
affidavit is true. (You learn more about affidavits and declarations in Chapter 14.)
In general, after a judge approves and signs a search warrant, it’s ready to be executed, meaning a DEFR can collect evidence as defined by the warrant. After you collect the evidence, you
process and analyze it to determine whether a crime actually occurred. The evidence can then
be presented in court in a hearing or trial. A judge or an administrative law judge then renders
a judgment, or a jury hands down a verdict (after which a judge can enter a judgment).
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
14
Chapter 1
Figure 1-7 Typical affidavit language
ª Cengage Learningâ
Understanding Private-Sector Investigations
Private-sector investigations involve private companies and lawyers who address company
policy violations and litigation disputes, such as wrongful termination. When conducting an
investigation for a private company, remember that business must continue with minimal
interruption from your investigation. Because businesses usually focus on continuing their usual
operations and making profits, many in a private-sector environment consider your investigation and apprehension of a suspect secondary to stopping the violation and minimizing damage
or loss to the business. Businesses also strive to minimize or eliminate litigation, which is an
expensive way to address criminal or civil issues. Private-sector computer crimes can involve
e-mail harassment, falsification of data, gender and age discrimination, embezzlement, sabotage, and industrial espionage, which involves selling sensitive or confidential company information to a competitor. Anyone with access to a computer can commit these crimes.
Establishing Company Policies One way that businesses can reduce the risk of
litigation is to publish and maintain policies that employees find easy to read and follow. In
addition, these policies can make internal investigations go more smoothly. The most important policies are those defining rules for using the company’s computers and networks; this type
of policy is commonly known as an “acceptable use policy.” Organizations should have all
employees sign this acceptable use agreement. Published company policies also provide a line
of authority for conducting internal investigations; it states who has the legal right to initiate
an investigation, who can take possession of evidence, and who can have access to evidence.
Well-defined policies give computer investigators and forensics examiners the authority to
conduct an investigation. Policies also demonstrate that an organization intends to be
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Preparing for Digital Investigations
15
fair-minded and objective about how it treats employees and state that the organization will
follow due process for all investigations. (“Due process” refers to fairness under the law and
is meant to protect all.) Without defined policies, a business risks exposing itself to litigation
from current or former employees. The person or committee in charge of maintaining company policies must also stay current with applicable laws, which can vary depending on the
city, state, and country. In addition, training and updates on standards and policies should be
scheduled regularly to keep employees informed of what should and shouldn’t be done on
the organization’s network.
Displaying Warning Banners Another way a private or public organization can
avoid litigation is to display a warning banner on computer screens. A warning banner usually appears when a computer starts or connects to the company intranet, network, or virtual
private network (VPN) and informs end users that the organization reserves the right to
inspect computer systems and network traffic at will. (An end user is a person using a computer to perform routine tasks other than system administration.) If this right isn’t stated explicitly, employees might have an assumed right of privacy when using a company’s
computer systems and network accesses. Figure 1-8 shows a sample warning banner.
Figure 1-8 A sample warning banner
ª Cengage Learningâ
A warning banner asserts the right to conduct an investigation and notifies the user. By displaying a strong, well-worded warning banner, an organization owning computer equipment
doesn’t need a search warrant or court order as required under Fourth Amendment searchand-seizure rules to seize the equipment. In a company with a well-defined policy, this right
to inspect or search at will applies to both criminal activity and company policy violations.
Keep in mind, however, that your country’s laws might differ. For example, in some countries, even though the company has the right to seize computers at any time, if employees are
suspected of a criminal act, they must be informed at that time.
The following list recommends phrases to include in warning banners. Before using these
warnings, consult with the organization’s legal department for other required legal notices
for your work area or department. Depending on the type of organization, the following text
can be used in internal warning banners:
•
Access to this system and network is restricted.
•
Use of this system and network is for official business only.
•
Systems and networks are subject to monitoring at any time by the owner.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
16
Chapter 1
•
Using this system implies consent to monitoring by the owner.
•
Unauthorized or illegal users of this system or network will be subject to discipline or
prosecution.
•
Users of this system agree that they have no expectation of privacy relating to all activity performed on this system.
The DOJ document at www.justice.gov/criminal/cybercrime/docs/
ssmanual2009.pdf has several examples of warning banners.
An organization such as a community college might simply state that systems and networks
are subject to observation and monitoring at any time because members of the local community who aren’t staff or students might use the facilities. A for-profit organization, on the
other hand, could have proprietary information on its network and use all the phrases suggested in the preceding list.
Guests, such as employees of business partners, might be allowed to use the system. The text
that’s displayed when a guest attempts to log on can include warnings similar to the
following:
•
This system is the property of Company X.
•
This system is for authorized use only; unauthorized access is a violation of law and
violators will be prosecuted.
•
All activity, software, network traffic, and communications are subject to monitoring.
As a private-sector digital investigator, make sure a company displays a clearly worded warning banner. Without a banner, your authority to inspect might conflict with the user’s expectation of privacy, and a court might have to determine the issue of authority to inspect. State
laws vary on the expectation of privacy, but all states accept the concept of a waiver of the
expectation of privacy. Additionally, the EU and its member nations impose substantial penalties for personal information that crosses national boundaries without the person’s consent.
For example, if your company is conducting an investigation at its subsidiary in the EU, you
might not be able to acquire a network drive without notifying certain parties or making sure
consent documents are in place.
Some might argue that written policies are all that are necessary. However, in the actual prosecution of cases, warning banners have been critical in determining that a user didn’t have an
expectation of privacy for information stored on the system. A warning banner has the additional advantage of being easier to present in trial as an exhibit than a policy manual. Government agencies, such as the Department of Energy, NASA, Lawrence Livermore Labs, and
even public libraries, now require warning banners on all computer terminals on their systems. Many corporations also require warning banners as part of the logon/startup process.
Designating an Authorized Requester As mentioned, investigations must establish a line of authority. In addition to using warning banners that state a company’s rights
of computer ownership, businesses are advised to specify an authorized requester who has
the power to initiate investigations. Executive management should define a policy to avoid
conflicts from competing interests in organizations. In large organizations, competition for
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Preparing for Digital Investigations
17
funding or management support can become so fierce that people might create false allegations of misconduct to prevent competing departments from delivering a proposal for the
same source of funds.
To avoid inappropriate investigations, executive management must also define and limit
who’s authorized to request a computer investigation and forensics analysis. Generally, the
fewer groups with authority to request a computer investigation, the better. Examples of
groups with this authority in a private-sector environment include following:
•
Corporate security investigations
•
Corporate ethics office
•
Corporate equal employment opportunity office
•
Internal auditing
•
The general counsel or legal department
All other groups should coordinate their requests through the corporate security investigations
group. This policy separates the investigative process from the process of employee discipline.
Conducting Security Investigations Conducting a digital investigation in the
private sector is not much different from conducting one in the public sector. During public
investigations, you search for evidence to support criminal allegations. During private
investigations, you search for evidence to support allegations of violations of a company’s
rules or an attack on its assets. Three types of situations are common in private-sector
environments:
•
Abuse or misuse of computing assets
•
E-mail abuse
•
Internet abuse
Most digital investigations in the private sector involve misuse of computing assets. Typically,
this misuse is referred to as “company rules violation.” Computing abuse complaints often
center on e-mail and Internet misuse by employees but could involve other computing resources, such as using company software to produce a product for personal profit. The scope of
an e-mail investigation ranges from excessive use of a company’s e-mail system for personal
use to making threats or harassing others via e-mail. Some common e-mail abuses involve
transmitting offensive messages. These types of messages can create a hostile work environment that can result in an employee civil lawsuit against a company that does nothing to prevent or respond to it (in other words, implicitly condones the e-mail abuse).
Digital investigators also examine Internet abuse. Employees’ abuse of Internet privileges
ranges from excessive use, such as spending all day Web surfing, to viewing pornographic
pictures on the Internet while at work. An extreme instance of Internet abuse is viewing contraband (illegal) pornographic images, such as child pornography. Viewing contraband
images is a criminal act in most jurisdictions, and digital investigators must handle this situation with the highest level of professionalism and notify law enforcement. By enforcing policies consistently, a company minimizes its liability exposure. The role of a digital forensics
examiner is to give management personnel complete and accurate information so that they
can verify and correct abuse problems in an organization. (In later chapters, you learn the
procedures for conducting these types of investigations.)
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
18
Chapter 1
Actions that seem related to internal abuse could also have criminal or civil liability. Because
any civil investigation can become a criminal investigation, you must treat all evidence you
collect with the highest level of security and accountability. Later in this book, you learn the
Federal Rules of Evidence (processes to ensure the chain of custody) and how to apply them
to computing investigations.
Similarly, your private-sector investigation might seem to involve a civil, noncriminal matter,
but as you progress through your analysis, you might identify a criminal matter, too. Because
of this possibility, always remember that your work can come under the scrutiny of the civil
or criminal legal system. The Federal Rules of Evidence are the same for civil and criminal
matters. By applying the rules to all investigations uniformly, you eliminate any concerns
about the admissibility of the evidence you develop. These standards are emphasized
throughout this book.
The silver-platter doctrine used to allow a civilian or private-sector
investigative agent to deliver evidence obtained in a manner that violated the Fourth Amendment to a law enforcement agency. However,
this doctrine was ruled unconstitutional in 1960 (see Elkins v. United
States, 1960).
Remember that a police officer is a law enforcement agent. A private-sector investigator’s job
is to minimize risk to the company. After you turn over evidence to law enforcement and
begin working under their direction, you become an agent of law enforcement, subject to the
same restrictions on search and seizure as a law enforcement agent. A law enforcement agent
can’t ask you, as a private citizen, to obtain evidence that requires a warrant. The rules controlling the use of evidence collected by private citizens vary by jurisdiction, so check the law
if you’re investigating a case outside the United States.
Litigation is costly, so after you have assembled evidence, offending employees are usually
disciplined. However, when you discover that a criminal act involving a third-party victim
has been committed, you might have a legal and moral obligation to turn the information
over to law enforcement. In the next section, you learn about situations in which criminal evidence must be separated from any company proprietary information.
Distinguishing Personal and Company Property Many company policies
distinguish between personal and company computer property; however, making this distinction can be difficult with cell phones, smartphones, personal notebooks, and tablet computers. For example, an employee brings her personal tablet to work and connects it to the
company’s wireless network. As the employee synchronizes information on the tablet with
information in the company network, she copies some data in the tablet to the company network. During the synchronization, data on the company computer or network might be
placed on the tablet, too. In this case, at least one question is “Does the information on the
tablet belong to the company or the employee?”
Now suppose the company gave the employee the tablet as a holiday bonus. Can the company
claim rights to this device? Similar issues come up when an employee brings in a smartphone
and connects it to the company network. What rules apply? Because digital devices are part of
daily life, you’ll encounter these issues often. These questions are still being debated, however,
and companies are establishing their own policies to handle them. In today’s bring your own
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Maintaining Professional Conduct
19
device (BYOD) environment, more companies are forced to address the issue of personal devices accessing the company network. Some companies simply state that if you connect a personal device to the business network, it falls under the same rules as company property.
BYOD is a major challenge in company security, digital investigations,
and compliance with regulations, including company policies.
Maintaining Professional Conduct
Your professional conduct as a digital investigator is critical because it determines your credibility. Professional conduct, discussed in more detail in Chapters 15 and 16, includes ethics,
morals, and standards of behavior. As a professional, you must exhibit the highest level of
professional behavior at all times. To do so, you must maintain objectivity and confidentiality
during an investigation, expand your technical knowledge constantly, and conduct yourself
with integrity. Maintaining objectivity means you form opinions based on your education,
training, experience, and the evidence in your cases. Avoid making conclusions about your
findings until you have exhausted all reasonable leads and considered the available facts.
Your ultimate responsibility is to find relevant digital evidence. You must avoid prejudice or
bias to maintain the integrity of your fact-finding in all investigations. For example, if you’re
employed by an attorney, don’t allow the attorney’s agenda to dictate the outcome of your
investigation. Your reputation depends on maintaining your objectivity.
You must also maintain an investigation’s credibility by maintaining confidentiality. Discuss
the case only with people who need to know about it, such as other investigators involved in
the case or someone in the line of authority. If you need advice from other professionals, discuss only the general terms and facts about the case without mentioning specifics. All investigations you conduct must be kept confidential, until you’re designated as a witness or
required by the attorney or court to release a report.
In the corporate environment, confidentiality is critical, especially when dealing with employees who have been terminated. The agreement between the company and the employee might
have been to represent the termination as a layoff or resignation in exchange for no bad references. If you give case details and the employee’s name to others, your company could be
liable for breach of contract.
In some instances, your corporate case might become a criminal case, and it could be years
before the case finally goes to trial or is settled. If an investigator talks about evidence with
unauthorized people, the case could be damaged. When working for an attorney on an investigation, the attorney-work-product rule applies to all communications. This means you can
discuss the case only with the attorney or other members of the team working with the attorney. All communication about the case to other people requires the attorney’s approval.
In addition to maintaining objectivity and confidentiality, you can enhance your professional
conduct by continuing your training. The field of digital investigations and forensics is changing constantly. You should stay current with the latest technical changes in computer hardware and software, networking, and forensic tools. You should also learn about the latest
investigation techniques you can use in your cases.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
20
Chapter 1
To continue your professional training, you should attend workshops, conferences, and
vendor courses. You might also need to continue or enhance your formal education, such as
pursuing certifications. You improve your professional standing if you have at least an undergraduate degree in computing or a related field. If you don’t have an advanced degree,
consider graduate-level studies in a complementary area of study, such as business law or
e-commerce. Several colleges and universities now offer associate’s, bachelor’s, and master’s
degrees and certificate programs in digital forensics. Many companies are willing to assist
with employee education expenses because it’s to their advantage that employees remain
current in their knowledge.
In addition to education and training, membership in professional organizations adds to your
credentials. These organizations often sponsor training and publications on the latest technical improvements and trends in digital forensic examinations. Also, keep up to date with the
most current publications on digital forensics examination tools and techniques.
As a digital investigator and forensics professional, you’re expected to maintain honesty and
integrity. You must conduct yourself with the highest levels of integrity in all aspects of your
life. Any indiscreet actions can embarrass you and give opposing attorneys opportunities to
discredit you during your testimony in court or in depositions.
Preparing a Digital Forensics Investigation
Your role as a digital forensics professional is to gather data from a suspect’s computer and
determine whether there’s evidence that a crime was committed or company policy or industry regulations had been violated. If the evidence suggests that a crime or policy violation has
been committed, you begin to prepare a case, which is a collection of evidence you can offer
in court or at a private-sector inquiry. This process involves investigating the suspect’s computer and then preserving the evidence on a different computer. Before you begin investigating, however, you must follow an accepted procedure to prepare a case. By approaching each
case methodically, you can evaluate the evidence thoroughly and document the chain of evidence, or chain of custody, which is the route the evidence takes from the time you find it
until the case is closed or goes to court.
The following sections present two sample cases—one involving a computer crime and another
involving a company policy violation. Each example describes the typical steps of a forensics
investigation, including gathering evidence, preparing a case, and preserving the evidence.
An Overview of a Computer Crime
Law enforcement officers often find computers, smartphones, and other devices as they’re
investigating crimes, gathering other evidence, or making arrests. These devices can contain
information that helps law enforcement officers determine the chain of events leading to a
crime or information providing evidence that’s more likely to lead to a conviction. As an
example of a case in which computers were involved in a crime, the police raided a suspected
drug dealer’s home and found a desktop computer, several USB drives (also called “flash
drives” or “thumb drives”), a tablet computer, and a cell phone in a bedroom (see Figure 1-9).
The computer was “bagged and tagged,” meaning it was placed in evidence bags along with
the storage media and then labeled with tags as part of the search and seizure.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Preparing a Digital Forensics Investigation
21
1
Figure 1-9 The crime scene
ª Cengage Learningâ
The lead detective on the case wants you to examine the computer and cell phone to find and
organize data that could be evidence of a crime, such as files containing names of the drug
dealer’s contacts, text messages, and photos. The acquisitions officer gives you documentation of items the investigating officers collected with the computer, including a list of other
storage media, such as removable disks and flash drives. The acquisitions officer also notes
that the computer is a Windows 8 system, and the machine was running when it was discovered. Before shutting down the computer, the acquisitions officer photographs all open windows on the Windows desktop, including one showing File Explorer, and gives you the
photos. (Before shutting down the computer, a live acquisition should be done to capture
RAM, too. This procedure is discussed in Chapter 10.)
As a digital forensics investigator, you’re grateful the officers followed proper procedure
when acquiring the evidence. With digital evidence, it’s important to realize how easily key
data, such as the last access date, can be altered by an overeager investigator who’s first on
the scene. The U.S. DOJ has a document you can download that reviews the correct acquisition of electronic evidence, “Prosecuting Computer Crimes” (www.justice.gov/criminal/
cybercrime/docs/ssmanual2009.pdf, 2009). If this link has changed because of site updates,
use the search feature.
In your preliminary assessment, you assume that the hard disk and storage media include intact
files, such as e-mail messages, deleted files, and hidden files. A range of software is available
for use in your investigation; your office uses the tool Technology Pathways ProDiscover.
This chapter introduces you to the principles applied to digital forensics. In Chapter 6, you learn the strengths and weaknesses of several
software packages.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
22
Chapter 1
Because some cases involve computers running legacy OSs, older versions of tools often need to be used in forensics investigations. For
example, Norton DiskEdit is an older tool that was last available on the
Norton System Works 2000 CD.
After your preliminary assessment, you identify the potential challenges in this case. Later,
you perform the steps needed to investigate the case, including how to address risks and
obstacles. Then you can begin the actual investigation and data retrieval.
An Overview of a Company Policy Violation
Companies often establish policies for employee use of computers. Employees surfing the
Internet, sending personal e-mail, or using company computers for personal tasks during
work hours can waste company time. Because lost time can cost companies millions of dollars, digital forensics specialists are often used to investigate policy violations. The following
example describes a company policy violation.
Manager Steve Billings has been receiving complaints from customers about the job performance of one of his sales representatives, George Montgomery. George has worked as a representative for several years. He’s been absent from work for two days but hasn’t called in sick
or told anyone why he wouldn’t be at work. Another employee, Martha, is also missing and
hasn’t informed anyone of the reason for her absence. Steve asks the IT Department to confiscate George’s hard drive and all storage media in his work area. He wants to know whether
any information on George’s computer and storage media might offer a clue to his whereabouts and job performance concerns. To help determine George’s and Martha’s whereabouts, you must take a systematic approach, described in the following section, to
examining and analyzing the data found on George’s desk.
Taking a Systematic Approach
When preparing a case, you can apply standard systems analysis steps, explained in the following list, to problem solving. Later in this chapter, you apply these steps to cases.
•
Make an initial assessment about the type of case you’re investigating—To assess the
type of case you’re handling, talk to others involved in the case and ask questions
about the incident. Have law enforcement or company security officers already seized
the computer, disks, peripherals, and other components? Do you need to visit an office
or another location? Was the computer used to commit a crime, or does it contain
evidence about another crime?
•
Determine a preliminary design or approach to the case—Outline the general steps
you need to follow to investigate the case. If the suspect is an employee and you need
to acquire his or her system, determine whether you can seize the computer during
work hours or have to wait until evening or weekend hours. If you’re preparing a
criminal case, determine what information law enforcement officers have already
gathered.
•
Create a detailed checklist—Refine the general outline by creating a detailed checklist
of steps and an estimated amount of time for each step. This outline helps you stay on
track during the investigation.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Preparing a Digital Forensics Investigation
23
•
Determine the resources you need—Based on the OS of the computer you’re investigating, list the software you plan to use for the investigation, noting any other software,
tools, or expert assistance you might need.
•
Obtain and copy an evidence drive—In some cases, you might be seizing multiple computers
along with CDs, DVDs, USB drives, mobile devices, and other removable media. (For the
examples in this chapter, you’re using only USB drives.) Make a forensic copy of the disk.
•
Identify the risks—List the problems you normally expect in the type of case you’re
handling. This list is known as a standard risk assessment. For example, if the suspect
seems knowledgeable about computers, he or she might have set up a logon scheme
that shuts down the computer or overwrites data on the hard disk when someone tries
to change the logon password.
•
Mitigate or minimize the risks—Identify how you can minimize the risks. For example,
if you’re working with a computer on which the suspect has likely password-protected
the hard drive, you can make multiple copies of the original media before starting.
Then if you destroy a copy during the process of retrieving information from the disk,
you have additional copies.
•
Test the design—Review the decisions you’ve made and the steps you’ve completed. If
you have already copied the original media, a standard part of testing the design
involves comparing hash values (discussed in Chapters 3 and 4) to ensure that you
copied the original media correctly.
•
Analyze and recover the digital evidence—Using the software tools and other resources
you’ve gathered, and making sure you’ve addressed any risks and obstacles, examine
the disk to find digital evidence.
•
Investigate the data you recover—View the information recovered from the disk,
including existing files, deleted files, e-mail, and Web history, and organize the files to
help find information relevant to the case.
•
Complete the case report—Write a complete report detailing what you did and what
you found.
•
Critique the case—Self-evaluation and peer review are essential parts of professional
growth. After you complete a case, review it to identify successful decisions and actions
and determine how you could have improved your performance.
The amount of time and effort you put into each step varies, depending on the nature of the
investigation. For example, in most cases, you need to create a simple investigation plan so
that you don’t overlook any steps. However, if a case involves many computers with complex
issues to identify and examine, a detailed plan with periodic review and updates is essential.
A systematic approach helps you discover the information you need for your case, and you
should gather as much information as possible.
For all computing investigations, you must be prepared for the unexpected, so you should
always have a contingency plan for the investigation. A contingency plan can consist of anything to help you complete the investigation, from alternative software and hardware tools to
other methods of approaching the investigation.
Assessing the Case As mentioned, identifying case requirements involves determining
the type of case you’re investigating. Doing so means you should outline the case details
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
24
Chapter 1
systematically, including the nature of the case, the type of evidence available, and the location of evidence.
In the company-policy violation case, you have been asked to investigate George Montgomery. Steve Billings had the IT Department confiscate George’s storage media that might contain information about his whereabouts. After talking to George’s co-workers, Steve learned
that George has been conducting a personal business on the side using company computers.
Therefore, the focus of the case has shifted to include possible employee abuse of company
resources. You can begin assessing this case as follows:
•
Situation—Employee abuse of resources.
•
Nature of the case—Side business conducted on the company computer.
•
Specifics of the case—The employee is reportedly conducting a side business on his
company computer that involves registering domain names for clients and setting up
their Web sites at local ISPs. Co-workers have complained that he’s been spending too
much time on his own business and not performing his assigned work duties. Company
policy states that all company-owned computing assets are subject to inspection by
company management at any time. Employees have no expectation of privacy when
operating company computer systems.
•
Type of evidence—Small-capacity USB drive connected to a company computer.
•
Known disk format—NTFS.
•
Location of evidence—One USB drive recovered from the employee’s assigned
computer.
Based on these details, you can determine the case requirements. You now know that the nature of the case involves employee abuse of company resources, and you’re looking for evidence that an employee was conducting a side business using his employer’s computers. On
the USB drive retrieved from George’s computer, you’re looking for any information related
to Web sites, ISPs, or domain names. You know that the USB drive uses the NTFS file system.
To duplicate the USB drive and find deleted and hidden files, you need a reliable digital forensics tool. Because the USB drive has already been retrieved, you don’t need to seize the drive
yourself.
You call this case Montgomery 72015 (because the case opened on July 20, 2015) and determine that your task is to gather data from the storage media seized to confirm or deny the allegation that George is conducting a side business on company time and computers.
Remember that he’s suspected only of resource abuse, and the evidence you obtain might be
exculpatory—meaning it could prove his innocence. You must always maintain an unbiased
perspective and be objective in your fact-findings. If you are systematic and thorough, you’re
more likely to produce consistently reliable results.
Planning Your Investigation Now that you have identified the requirements of the
Montgomery 72015 case, you can plan your investigation. You have already determined the
kind of evidence you need; now you can identify the specific steps to gather the evidence, establish a chain of custody, and perform the forensic analysis. These steps become the basic
plan for your investigation and indicate what you should do and when. To investigate the
Montgomery 72015 case, you should perform the following general steps. Most of these
steps are explained in more detail in the following sections.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Preparing a Digital Forensics Investigation
25
1. Acquire the USB drive from the IT Department, which bagged and tagged the evidence.
2. Complete an evidence form and establish a chain of custody.
3. Transport the evidence to your digital forensics lab.
4. Place the evidence in an approved secure container.
5. Prepare your forensic workstation.
6. Retrieve the evidence from the secure container.
7. Make a forensic copy of the evidence drive (in this case, the USB drive).
8. Return the evidence drive to the secure container.
9. Process the copied evidence drive with your digital forensics tools.
The approved secure container you need in Step 4 should be a locked,
fireproof locker or cabinet that has limited access. Limited access
means that only you and other authorized personnel can open the
secure container.
The first rule for all investigations is to preserve the evidence, which means it shouldn’t be
tampered with or contaminated. Because the IT Department staff confiscated the storage
media, you need to go to them for the evidence. The IT Department manager confirms that
the storage media has been locked in a secure cabinet since it was retrieved from George’s
desk. Keep in mind that even though this case is a company policy matter, many cases are
thrown out because the chain of custody can’t be proved or has been broken. When this happens, there’s the possibility that the evidence has been compromised.
To document the evidence, you record details about the media, including who recovered the
evidence and when and who possessed it and when. Use an evidence custody form, also called
a chain-of-evidence form, which helps you document what has and has not been done with
the original evidence and forensic copies of the evidence. Depending on whether you’re working in law enforcement or private security, you can create an evidence custody form to fit
your environment. This form should be easy to read and use. It can contain information for
one or several pieces of evidence. Consider creating a single-evidence form (which lists each
piece of evidence on a separate page) and a multi-evidence form (see Figure 1-10), depending
on the administrative needs of your investigation.
If necessary, document how to use your evidence custody form. Clear instructions help users
remain consistent when completing the form and ensure that everyone uses the same definitions for collected items. Standardization helps maintain consistent quality for all investigations and prevent confusion and mistakes about the evidence you collect. An evidence
custody form usually contains the following information:
•
Case number—The number your organization assigns when an investigation is
initiated.
•
Investigating organization—The name of your organization. In large corporations with
global facilities, several organizations might be conducting investigations in different
geographic areas.
•
Investigator—The name of the investigator assigned to the case. If many investigators
are assigned, specify the lead investigator’s name.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
26
Chapter 1
Figure 1-10 A sample multi-evidence form used in a private-sector environment
ª Cengage Learningâ
•
Nature of case—A short description of the case. For example, in the private-sector
environment, it might be “data recovery for corporate litigation” or “employee policy
violation case.”
•
Location evidence was obtained—The exact location where the evidence was collected.
If you’re using multi-evidence forms, a new form should be created for each location.
•
Description of evidence—A list of the evidence items, such as “hard drive, 250 GB” or
“one USB drive, 8 GB.” On a multi-evidence form, write a description for each item of
evidence you acquire and possibly include photos.
•
Vendor name—The name of the manufacturer of the computer component. List a
250 GB hard drive, for example, as a “Maxtor 250 GB hard drive,” or describe a USB
drive as a “SanDisk 8 GB USB drive.” In later chapters, you see how differences among
manufacturers can affect data recovery.
•
Model number or serial number—List the model number or serial number (if
available) of the computer component. Many computer components, including hard
drives, memory chips, and expansion slot cards, have model numbers but not serial
numbers.
•
Evidence recovered by—The name of the investigator who recovered the evidence. The
chain of custody for evidence starts with this information. If you insert your name, for
example, you’re declaring that you have taken control of the evidence. It’s now your
responsibility to ensure that nothing damages the evidence and no one tampers with it.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Preparing a Digital Forensics Investigation
27
The person placing his or her name on this line is responsible for preserving, transporting, and securing the evidence.
•
Date and time—The date and time the evidence was taken into custody. This information establishes exactly when the chain of custody starts.
•
Evidence placed in locker—Specifies which approved secure container is used to store
evidence and when the evidence was placed in the container.
•
Item #/Evidence processed by/Disposition of evidence/Date/Time—When you or
another authorized investigator retrieves evidence from the evidence locker for
processing and analysis, list the item number and your name, and then describe what
was done to the evidence.
•
Page—The forms used to catalog all evidence for each location should have page numbers. List the page number, and indicate the total number of pages for this group of
evidence. For example, if you collected 15 pieces of evidence at one location and your
form has only 10 lines, you need to fill out two multi-evidence forms. The first form is
noted as “Page 1 of 2,” and the second page is noted as “Page 2 of 2.”
Figure 1-11 shows a single-evidence form, which lists only one piece of evidence per page.
This form gives you more flexibility in tracking separate pieces of evidence for your chain-ofcustody log. It also has more space for descriptions, which is helpful when finalizing the
investigation and creating a case report. With this form, you can accurately account for what
was done to the evidence and what was found. Use evidence forms as a reference for all
actions taken during your investigative analysis.
Figure 1-11 A single-evidence form
ª Cengage Learningâ
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
28
Chapter 1
You can use both multi-evidence and single-evidence forms in your investigation. By using
two forms, you can keep the single-evidence form with the evidence and the multi-evidence
form in your report file. Two forms also provide redundancy that can be used as a quality
control for evidence.
Securing Your Evidence Computing investigations demand that you adjust your
procedures to suit the case. For example, if the evidence for a case includes an entire computer system and associated storage media, such as flash drives and large external hard
drives, you must be flexible when you account for all these items. Some evidence is small
enough to fit into an evidence bag. Other items, such as CPU cabinets, monitors, keyboards,
and printers, are too large.
To secure and catalog the evidence contained in large computer components, you can use
large evidence bags, tape, tags, labels, and other products available from police supply vendors or office supply stores. When gathering products to secure your computer evidence,
make sure they are safe and effective to use on computer components. Be cautious when handling any computer component to avoid damaging the component or coming into contact
with static electricity, which can destroy digital data. For this reason, make sure you use antistatic bags when collecting computer evidence. Consider using an antistatic pad with an
attached wrist strap, too. Both help prevent damage to computer evidence.
This section focuses on securing computers and related hardware.
Devices such as smartphones and cell phones are covered later in
Chapter 12.
Be sure to place computer evidence in a well-padded container. Padding prevents damage to
the evidence as you transport it to your secure evidence locker, evidence room, or computer
lab. Save discarded hard drive boxes, antistatic bags, and packing material for computer
hardware when you or others acquire computer devices.
Because you might not have everything needed to secure your evidence, you have to improvise. Securing evidence often requires building secure containers. If the computer component
is large and contained in its own casing, you can use evidence tape to seal all openings on the
cabinet. Placing evidence tape over drive bays, insertion slots for power supply cords and
USB cables, and any other openings ensures the security of evidence. As a standard practice,
you should write your initials on the tape before applying it to the evidence. This practice
makes it possible to prove later in court that the evidence hasn’t been tampered with because
the casing couldn’t have been opened nor could power have been supplied to the closed casing with this tape in place. If the tape had been replaced, your initials wouldn’t be present,
which would indicate tampering. If you transport a computer, place new disks in disk drives
to reduce possible drive damage while you’re moving it.
Computer components require specific temperature and humidity ranges. If it’s too cold,
hot, or wet, computer components and magnetic media can be damaged. Even heated car
seats can damage digital media, and placing a computer on top of a two-way car radio in
the trunk can damage magnetic media. When collecting computer evidence, make sure you
have a safe environment for transporting and storing it until a secure evidence container
is available.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Procedures for Private-Sector High-Tech Investigations
29
Procedures for Private-Sector High-Tech Investigations
As an investigator, you need to develop formal procedures and informal checklists to cover
all issues important to high-tech investigations. These procedures are necessary to ensure that
correct techniques are used in an investigation. Use informal checklists to be certain that all
evidence is collected and processed correctly. This section lists some sample procedures that
computing investigators commonly use in private-sector high-tech investigations.
Employee Termination Cases
Most investigative work for termination cases involves employee abuse of company resources. Incidents that create a hostile work environment, such as viewing pornography in the
workplace and sending inappropriate e-mails, are the predominant types of cases investigated. The following sections describe key points for conducting an investigation that might
lead to an employee’s termination. Consulting with your organization’s general counsel and
Human Resources Department for specific directions on how to handle these investigations is
recommended. Your organization must have appropriate policies in place, as described previously in this chapter.
Internet Abuse Investigations
The information in this section applies to an organization’s internal private network, not a
public ISP. Consult with your organization’s general counsel after reviewing this list, and
make changes according to their directions to build your own procedures. To conduct an
investigation involving Internet abuse, you need the following:
•
The organization’s Internet proxy server logs
•
Suspect computer’s IP address obtained from your organization’s network
administrator
•
Suspect computer’s disk drive
•
Your preferred digital forensics analysis tool (ProDiscover, Forensic Toolkit, EnCase,
X-Ways Forensics, and so forth)
The following steps outline the recommended processing of an Internet abuse case:
1. Use the standard forensic analysis techniques and procedures described in this book for
the disk drive examination.
2. Using tools such as Magnet Forensics Internet Evidence Finder or Forensic Toolkit’s Internet keyword search option, extract all Web page URLs and other associated information.
3. Contact the network firewall administrator and request a proxy server log, if it’s
available, of the suspect computer’s network device name or IP address for the dates
of interest. Consult with your organization’s network administrator to confirm that
these logs are maintained and how long the time to live (TTL) is set for the network’s
IP address assignments that use Dynamic Host Configuration Protocol (DHCP).
4. Compare the data recovered from forensics analysis with the network server log data
to confirm that they match.
5. If the URL data matches the network server log and the forensic disk examination,
continue analyzing the suspect computer’s drive data, and collect any relevant photos
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
30
Chapter 1
or Web pages that support the allegation. If there are no matches between the network
server logs, and the forensic examination shows no contributing evidence, report that
the allegation is unsubstantiated.
Before investigating an Internet abuse case, research your state or country’s privacy laws.
Many countries have unique privacy laws that restrict the use of computer log data, such as
network server logs or disk drive cache files, for any type of investigation. Some state or federal laws might supersede your organization’s employee policies. Always consult with your
organization’s attorney. For companies with international business operations, jurisdiction is
a problem; what’s legal in the United States, such as examining and investigating a network
server log, might not be legal in Germany, for example.
For investigations in which the network server log doesn’t match the forensics analysis that
found inappropriate data, continue the examination of the suspect computer’s disk drive.
Determine when inappropriate data was downloaded to the computer and whether it was
through an organization’s intranet connection to the Internet. Employees might have used
their employer’s laptop computers to connect to their own ISPs to download inappropriate
Web content. For these situations, you need to consult your organization’s employee policy
guidelines for what’s considered appropriate use of the organization’s computing resources.
E-mail Abuse Investigations
E-mail investigations typically include spam, inappropriate and offensive message content,
and harassment or threats. E-mail is subject to the same restrictions as other computer evidence data, in that an organization must have a defined policy, as described previously. The
following list is what you need for an investigation involving e-mail abuse:
•
An electronic copy of the offending e-mail that contains message header data; consult
with your e-mail server administrator
•
If available, e-mail server log records; consult with your e-mail server administrator to
see whether they are available
•
For e-mail systems that store users’ messages on a central server, access to the server;
consult with your e-mail server administrator
•
For e-mail systems that store users’ messages on a computer as an Outlook .pst or
.ost file, for example, access to the computer so that you can perform a forensic
analysis on it
•
Your preferred digital forensics analysis tool, such as OS Forensics or ProDiscover
The following steps outline the recommended procedure for e-mail investigations:
1. For computer-based e-mail data files, such as Outlook .pst or .ost files, use the
standard forensic analysis techniques and procedures described in this book for the
drive examination.
2. For server-based e-mail data files, contact the e-mail server administrator and obtain
an electronic copy of the suspect’s and victim’s e-mail folder or data.
3. For Web-based e-mail (Gmail, for example) investigations, use tools such as Forensic
Toolkit’s Internet keyword search option to extract all related e-mail address information.
4. Examine header data of all messages of interest to the investigation.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Procedures for Private-Sector High-Tech Investigations
31
Attorney-Client Privilege Investigations
When conducting a digital forensics analysis under attorney-client privilege (ACP) rules for
an attorney, you must keep all findings confidential. The attorney you’re working for is the
ultimate authority over the investigation. For investigations of this nature, attorneys typically
request that you extract all data from drives. It’s your responsibility to comply with the attorney’s directions. Because of the large quantities of data a drive can contain, the attorney will
want to know about everything of interest on the drives.
Many attorneys like to have printouts of the data you have recovered, but printouts can pose
problems when you have log files with several thousand pages of data or CAD drawing programs that can be read only by proprietary programs. You need to persuade and educate
many attorneys on how digital evidence can be viewed electronically. In addition, learn how
to teach attorneys and paralegals to sort through files so that you can help them efficiently
analyze the huge amount of data a forensic examination produces.
You can also encounter problems if you find data in the form of binary files, such as CAD
drawings. Examining these files requires using the CAD program that created them. In addition, engineering companies often have specialized drafting programs. Discovery demands
for lawsuits involving a product that caused injury or death requires extracting design
plans for attorneys and expert witnesses to review. You’re responsible for locating the programs for these design plans so that attorneys and expert witnesses can view the evidence files.
The following list shows the basic steps for conducting an ACP case:
1. Request a memorandum from the attorney directing you to start the investigation.
The memorandum must state that the investigation is privileged communication and
list your name and any other associates’ names assigned to the case.
2. Request a list of keywords of interest to the investigation.
3. After you have received the memorandum, initiate the investigation and analysis. Any
findings you made before receiving the memorandum are subject to discovery by the
opposing attorney.
4. For drive examinations, make two bit-stream images (discussed later in this chapter)
of the drive using a different tool for each image, such as EnCase for the first and
ProDiscover or FTK Imager for the second. This approach is advisable because every
tool has its strengths and weaknesses. If you have large enough storage drives, make
each bit-stream image uncompressed so that if it becomes corrupt, you can still
examine uncorrupted areas with your preferred forensics analysis tool.
5. Verify the hash values on all files on the original and re-created disks.
6. Methodically examine every portion of the drive (both allocated and unallocated data
areas) and extract all data.
7. Run keyword searches on allocated and unallocated disk space. Follow up the search
results to determine whether the search results contain information that supports the
case.
8. For Windows OSs, use specialty tools to analyze and extract data from the Registry,
such as AccessData Registry Viewer or a Registry viewer program (discussed in more
detail in Chapter 5). Use the Edit, Find menu option in Registry Editor, for example,
to search for keywords of interest to the investigation.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
32
Chapter 1
9. For binary files such as CAD drawings, locate the correct program and, if possible,
make printouts of the binary file content. If the files are too large, load the specialty
program on a separate workstation with the recovered binary files so that the attorney
can view them.
10. For unallocated data recovery, use a tool that removes or replaces nonprintable data,
such as X-Ways Forensics Specialist Gather Text function.
11. Consolidate all recovered data from the evidence bit-stream image into well-organized
folders and subfolders. Store the recovered data output, using a logical and easy-tofollow storage method for the attorney or paralegal.
Here are some other guidelines to remember for ACP cases:
•
Minimize all written communication with the attorney; use the telephone when you
need to ask questions or provide information related to the case.
•
Any documentation written to the attorney must contain a header stating that it’s
“Privileged Legal Communication—Confidential Work Product,” as defined under the
attorney-work-product rule.
•
Assist the attorney and paralegal in analyzing the data.
If you have difficulty complying with the directions or don’t understand the directives in the
memorandum, contact the attorney and explain the problem. Always keep an open line of
verbal communication with the attorney during these types of investigations. If you’re communicating via e-mail, use encryption or another secure e-mail service for all messages.
Industrial Espionage Investigations
Industrial espionage cases can be time consuming and are subject to scope creep problems
(meaning the investigation’s focus widens and becomes more time consuming). This section
offers some guidelines on how to deal with industrial espionage investigations. Be aware that
cases dealing with foreign nationals might be violations of International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR). For more information on
ITAR, see the U.S. Department of State’s Web site (www.state.gov; substitute the actual state
name or a shortened version for state) or do an Internet search for “International Traffic in
Arms Regulations.” For EAR information, see the U.S. Department of Commerce Web site
(www.doc.gov) or do an Internet search for “Export Administration Regulations.”
Unlike the other private-sector investigations covered in this section, all suspected industrial espionage cases should be treated as criminal investigations. The techniques described here are
for private network environments and internal investigations that haven’t yet been reported to
law enforcement officials. Make sure you don’t become an agent of law enforcement by filing a
complaint of a suspected espionage case before substantiating the allegation. The following list
includes staff you might need when planning an industrial espionage investigation. This list
isn’t exhaustive, so use your knowledge to improve on these recommendations:
•
The computing investigator who’s responsible for disk forensic examinations
•
The technology specialist who is knowledgeable about the suspected compromised
technical data
•
The network specialist who can perform log analysis and set up network monitors to
trap network communication of possible suspects
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Procedures for Private-Sector High-Tech Investigations
•
33
The threat assessment specialist (typically an attorney) who’s familiar with federal and
state laws and regulations related to ITAR or EAR and industrial espionage
The International Competition Network has established guidelines
(available at www.internationalcompetitionnetwork.org/uploads/library/
doc627.pdf) for digital evidence gathering in private-sector settings;
they’re used by more than 90 jurisdictions.
In addition, consider the following guidelines when initiating an international espionage
investigation:
•
Determine whether this investigation involves a possible industrial espionage incident,
and then determine whether it falls under ITAR or EAR.
•
Consult with corporate attorneys and upper management if the investigations must be
conducted discreetly.
•
Determine what information is needed to substantiate the allegation of industrial
espionage.
•
Generate a list of keywords for disk forensics and network monitoring.
•
List and collect resources needed for the investigation.
•
Determine the goal and scope of the investigation; consult with management and the
company’s attorneys on how much work you should do.
•
Initiate the investigation after approval from management, and make regular reports of
your activities and findings.
The following are planning considerations for industrial espionage investigations:
•
Examine all e-mail of suspected employees, both company-provided e-mail and free
Web-based services.
•
Search Internet forums or blogs for any postings related to the incident.
•
Initiate physical surveillance with cameras on people or things of interest to the
investigation.
•
If available, examine all facility physical access logs for sensitive areas, which might
include secure areas where smart badges or video surveillance recordings are used.
•
If there’s a suspect, determine his or her location in relation to the vulnerable resource
that was compromised.
•
Study the suspect’s work habits.
•
Collect all incoming and outgoing phone logs to see whether any unique or unusual
places were called.
When conducting an industrial espionage case, follow these basic steps:
1. Gather all personnel assigned to the investigation and brief them on the plan and any
concerns.
2. Gather the resources needed to conduct the investigation.
3. Start the investigation by placing surveillance systems, such as cameras and network
monitors, at key locations.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
34
Chapter 1
4. Discreetly gather any additional evidence, such as the suspect’s computer drive, and
make a bit-stream image for follow-up examination.
5. Collect all log data from networks and e-mail servers, and examine them for unique
items that might relate to the investigation.
6. Report regularly to management and corporate attorneys on your investigation’s status
and current findings.
7. Review the investigation’s scope with management and corporate attorneys to determine whether it needs to be expanded and more resources added.
Interviews and Interrogations in High-Tech Investigations
Becoming a skilled interviewer and interrogator can take many years of experience. Typically, a
private-sector digital investigator is a technical person acquiring the evidence for an investigation.
Many large organizations have full-time security investigators with years of training and experience
in criminal and civil investigations and interviewing techniques. Few of these investigators have
any computing or network technical skills, so you might be asked to assist in interviewing or interrogating a suspect when you have performed a forensic disk analysis on that suspect’s machine.
An interrogation is different from an interview. An interview is usually conducted to collect information from a witness or suspect about specific facts related to an investigation. An interrogation
is the process of trying to get a suspect to confess to a specific incident or crime. An investigator
might change from an interview to an interrogation when talking to a witness or suspect. The
more experience and training investigators have in the art of interviewing and interrogating, the
more easily they can determine whether a witness is credible and possibly a suspect.
Your role as a digital investigator is to instruct the investigator conducting the interview on
what questions to ask and what the answers should be. As you build rapport with the investigator, he or she might ask you to question the suspect. Watching a skilled interrogator is a
learning experience in human relations skills.
If you’re asked to assist in an interview or interrogation, prepare yourself by answering the
following questions:
•
What questions do I need to ask the suspect to get the vital information about the case?
•
Do I know what I’m talking about, or will I have to research the topic or technology
related to the investigation?
•
Do I need additional questions to cover other indirect issues related to the investigation?
Common interview and interrogation errors include being unprepared for the interview or
interrogation and not having the right questions or enough questions to increase your depth
of knowledge. Make sure you don’t run out of conversation topics; you need to keep the conversation friendly to gain the suspect’s confidence. Avoid doubting your own skills, which
might show the suspect you lack confidence in your ability. The ingredients for a successful
interview or interrogation include the following:
•
Being patient throughout the session
•
Repeating or rephrasing questions to zero in on specific facts from a reluctant witness
or suspect
•
Being tenacious
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding Data Recovery Workstations and Software
35
Understanding Data Recovery Workstations and
Software
Now you know what’s involved in acquiring and documenting evidence. In Chapter 2, you
examine a complete setup of a digital forensics lab, which is where you conduct your investigations and where most of your equipment and software are located, including secure evidence containers. Be aware that some companies that perform digital investigations also do
data recovery, e-discovery, and other related investigations.
Remember the difference between data recovery and digital forensics. In data recovery, typically, the customer or your company just wants the data back. The other key difference is
that in data recovery, you usually know what you’re trying to retrieve. In digital forensics,
you might have an idea of what you’re searching for, but not necessarily.
To conduct your investigation and analysis, you must have a specially configured PC known
as a forensic workstation, which is a computer loaded with additional bays and forensics
software. Depending on your needs, a forensic workstation can use the following operating
systems:
•
MS-DOS 6.22
•
Windows 95, 98, or Me
•
Windows NT 3.5 or 4.0
•
Windows 2000, XP, Vista, 7, or 8
•
Linux (including Kali Linux)
•
Mac OS X
Chapters 2 and 6 cover the software resources you need and the
forensics lab and workstation in detail. Visit www.digitalintelligence.com
to examine the specifications of the Forensic Recovery of Evidence Device
(F.R.E.D.) unit, or go to sites such as www.forensiccomputers.com to
look at current products.
If you start any operating system while you’re examining a hard disk, the OS alters the
evidence disk by writing data to the Recycle Bin and corrupts the quality and integrity of the
evidence you’re trying to preserve. Chapter 5 covers which files Windows updates automatically at startup. Windows XP and newer Windows OSs also record the serial numbers of
hard drives and CPUs in a file, which can be difficult to recover.
Of all the Microsoft OSs, the least intrusive (in terms of changing data) to disks is MS-DOS
6.22. With the continued evolution of Microsoft OSs, it’s not always practical to use older
MS-DOS platforms, however. Many older digital forensics acquisition tools work in the
MS-DOS environment. These tools can operate from an MS-DOS window in Windows 98 or
from the command prompt in Windows 2000 and later. Some of their functions are disabled
or generate error messages when run in these OSs, however.
Newer file system formats, such as NTFS, are accessible—that is, readable—only from Windows NT and later or any Linux OS. You can use one of several write-blockers that enable
you to boot to Windows without writing data to the evidence drive. In Chapter 3, you learn
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
36
Chapter 1
more about write-blockers and some inexpensive alternatives for preserving data during an
acquisition.
Many hardware write-blockers that connect to USB or FireWire ports are on the market. Several vendors sell write-blockers, including Technology Pathways NoWrite FPU; Digital Intelligence Ultra-Kit, UltraBlock, FireFly, FireChief 800, and USB Write Blocker; WiebeTECH
Forensic DriveDock; Guidance Software FastBloc; Paralan’s SCSI Write Blockers; and Intelligent Computer Solutions (www.ics-iq.com) Image LinkMASSter Forensics Hard Case.
Software write-blockers are available, too. Typically these write-blockers require a bootable
DVD or USB flash drive that runs an independent OS in a suspect computer’s RAM. For
more information on software write-blockers, see http://forensicsoft.com.
Windows products are being developed that make performing disk forensics easier. However,
because Windows has limitations in performing disk forensics, you need to develop skills in
acquiring data with Linux. In later chapters, you learn more about using these other tools.
Keep in mind that no single digital forensics tool can recover everything. Each tool and OS
has its own strengths and weaknesses, so develop skills with as many tools as possible to
become an effective computing investigator. Appendix D has additional information on how
to use MS-DOS for data acquisitions.
Setting Up Your Workstation for Digital Forensics
With current digital forensics hardware and software, configuring a computer workstation or
laptop as a forensic workstation is simple. All that’s required are the following:
•
A workstation running Windows XP or later
•
A write-blocker device
•
Digital forensics acquisition tool
•
Digital forensics analysis tool
•
A target drive to receive the source or suspect disk data
•
Spare PATA or SATA ports
•
USB ports
Additional useful items include the following:
•
Network interface card (NIC)
•
Extra USB ports
•
FireWire 400/800 ports
•
SCSI card
•
Disk editor tool
•
Text editor tool
•
Graphics viewer program
•
Other specialized viewing tools
In Chapter 2, you learn more about setting up and configuring a computer to be a forensic
workstation.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Conducting an Investigation
37
Conducting an Investigation
Now you’re ready to return to the Montgomery 72015 case. You have created a plan for the
investigation, set up your forensic workstation, and installed the necessary forensic analysis
software you need to examine the evidence. The type of software to install includes your preferred analysis tool, such as ProDiscover, EnCase, FTK, or X-Ways Forensics; an office suite,
such as LibreOffice; and a graphics viewer, such as IrfanView. To begin conducting an
investigation, you start by copying the evidence, using a variety of methods. No single
method retrieves all data from a disk, so using several tools to retrieve and analyze data is a
good idea.
Start by gathering the resources you identified in your investigation plan. You need the following items:
•
Original storage media
•
Evidence custody form
•
Evidence container for the storage media, such as an evidence bag
•
Bit-stream imaging tool; in this case, the ProDiscover Basic acquisition utility
•
Forensic workstation to copy and examine the evidence
•
Secure evidence locker, cabinet, or safe
Gathering the Evidence
Now you’re ready to gather evidence for the Montgomery 72015 case. Remember that you
need antistatic bags and pads with wrist straps to prevent static electricity from damaging
digital evidence. To acquire George Montgomery’s storage media from the IT Department
and then secure the evidence, you perform the following steps:
1. Arrange to meet the IT manager to interview him and pick up the storage media.
2. After interviewing the IT manager, fill out the evidence form, have him sign it, and then
sign it yourself.
3. Store the storage media in an evidence bag, and then transport it to your forensic
facility.
4. Carry the evidence to a secure container, such as a locker, cabinet, or safe.
5. Complete the evidence custody form. As mentioned, if you’re using a multi-evidence
form, you can store the form in the file folder for the case. If you’re also using singleevidence forms, store them in the secure container with the evidence. Reduce the risk of
tampering by limiting access to the forms.
6. Secure the evidence by locking the container.
Understanding Bit-stream Copies
A bit-stream copy is a bit-by-bit copy (also known as a “forensic copy”) of the original drive
or storage medium and is an exact duplicate. The more exact the copy, the better chance you
have of retrieving the evidence you need from the disk. This process is usually referred to as
“acquiring an image” or “making an image” of a suspect drive. A bit-stream copy is different
from a simple backup copy of a disk. Backup software can only copy or compress files that
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
38
Chapter 1
are stored in a folder or are of a known file type. Backup software can’t copy deleted files
and e-mails or recover file fragments.
A bit-stream image is the file containing the bit-stream copy of all data on a disk or disk partition. For simplicity, it’s usually referred to as an “image,” “image save,” or “image file.” To
create an exact image of an evidence disk, copying the image to a target disk that’s identical
to the evidence disk is preferable (see Figure 1-12). The target disk’s manufacturer and model,
in general, should be the same as the original disk’s manufacturer and model. If the target
disk is identical to the original, the size in bytes and sectors of both disks should also be the
same. Some image acquisition tools can accommodate a target disk that’s a different size than
the original. These imaging tools are discussed in Chapter 3. Older digital forensics tools
designed for MS-DOS work only on a copied disk. Current GUI tools can work on both a
disk drive and copied data sets that many manufacturers refer to as “image saves.”
Figure 1-12 Transfer of data from original to image to target
ª Cengage Learningâ
Occasionally, the track and sector maps on the original and target
disks don’t match, even if you use disks of exactly the same size that
are different makes or models. Tools such as Guidance EnCase and
NTI SafeBack adjust for the target drive’s geometry. Two other tools,
X-Ways WinHex Specialist Edition and Technology Pathways
ProDiscover, can copy sector by sector to equal-size or larger disks
without needing to force changes in the target disk’s geometry.
Acquiring an Image of Evidence Media
After you retrieve and secure the evidence, you’re ready to copy the evidence media and analyze the data. The first rule of digital forensics is to preserve the original evidence. Then conduct your analysis only on a copy of the data—the image of the original medium. Several
vendors provide MS-DOS, Linux, and Windows acquisition tools. Windows tools, however,
require a write-blocking device (discussed in Chapter 3) when acquiring data from FAT or
NTFS file systems.
Using ProDiscover Basic to Acquire a USB Drive
ProDiscover Basic from Technology Pathways is a forensic analysis tool. You can use it to
acquire and analyze data from several different file systems, such as Microsoft FAT and
NTFS; Linux Ext2, Ext3, and Ext4; and other UNIX file systems, from a Windows XP or
older OS.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Conducting an Investigation
39
The DVD accompanying this book includes ProDiscover Basic. The installation program includes a user manual, ProDiscoverManual.pdf,
in the C:nProgram Files (x86)nTechnology PathwaysnProDiscover folder
(if the installation defaults are used; for older Windows OS, look in the
C:nProgram FilesnTechnology PathwaysnProDiscover folder). Read the
user manual for instructions, and install ProDiscover Basic on your computer before you perform the following activity. In Windows Vista and
later, you must be in Administrator mode.
Before starting this activity, create a work folder on your computer for data storage and other
related files ProDiscover creates when acquiring and analyzing evidence. You can use any
location and name for your work folder, but you’ll see it referred to in activities as
“C:nWork” or simply “your work folder.” To keep your files organized, you should also create subfolders for each chapter. For this chapter, create a WorknChap01nChapter folder to
store files from in-chapter activities. Note that you might see work folder pathnames in
screenshots that are slightly different from your own pathname.
The following steps show how to acquire an image of a USB drive, but you can apply them
to other media, such as disk drives. You can use any USB drive already containing files to see
how ProDiscover acquires data. To perform an acquisition on a USB drive with ProDiscover
Basic, follow these steps:
1. On the USB drive, locate the write-protect switch (if one is available) and place the
drive in write-protect mode. Then connect the USB drive to your computer. (Most
current USB flash drives don’t have a write-block switch; for this activity, it’s assumed
that the USB flash drive has been write-protected.)
This activity is meant to introduce you to the ProDiscover Basic tool.
Proper forensics procedures require write-protecting any evidence
medium to make sure it’s not altered. In Chapter 3, you learn how to
use hardware and software write-blocking methods.
2. To start ProDiscover Basic in Windows 7 or earlier, click Start, point to
All Programs, click ProDiscover, and click ProDiscover Basic. In Windows 8,
click the ProDiscover icon in the Start screen. If the Launch Dialog dialog box opens
(see Figure 1-13), click Cancel.
If you’re using Windows Vista or later, right-click the ProDiscover Basic
desktop icon (or menu item on the All Programs menu) and click Run
as administrator. In the User Account Control (UAC) message box,
click Continue or Yes (in Windows 7).
3. In the main window, click Action, Capture Image from the menu.
4. In the Capture Image dialog box shown in Figure 1-14, click the Source Drive list
arrow, and select the USB drive.
5. Click the button next to the Destination text box and click Choose Local Path.
When the Save As dialog box opens, navigate to your work folder (WorknChap01n
Chapter) and enter a name for the image you’re making, such as InChp-prac. Click
Save to save the file.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
40
Chapter 1
Figure 1-13 The Launch Dialog dialog box in ProDiscover
Courtesy of Technology Pathways, LLC
Figure 1-14 The Capture Image dialog box
Courtesy of Technology Pathways, LLC
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Conducting an Investigation
41
6. Next, in the Capture Image dialog box, type your name in the Technician Name text
box and InChp-prac01 in the Image Number text box (see Figure 1-15). Click OK.
Figure 1-15 The completed Capture Image dialog box
Courtesy of Technology Pathways, LLC
ProDiscover Basic then acquires an image of the USB drive. When it’s
finished, it displays a notice to check the log file created during the
acquisition. This log file contains additional information if errors were
encountered during the data acquisition. ProDiscover also creates an
MD5 hash output file. In Chapters 3 and 4, you learn how to use
MD5 for forensic analysis and evidence validation.
7. When ProDiscover is finished, click OK in the completion message box. Click File, Exit
from the menu to exit ProDiscover.
This activity completes your first forensics data acquisition. Next, you learn how to locate
data in an acquisition.
Analyzing Your Digital Evidence
When you analyze digital evidence, your job is to recover the data. If users have deleted or
overwritten files on a disk, the disk contains deleted files and file fragments in addition to existing files. Remember that as files are deleted, the space they occupied becomes free space—
meaning it can be used for new files that are saved or files that expand as data is added to them.
The files that were deleted are still on the disk until a new file is saved to the same physical location, overwriting the original file. In the meantime, those files can still be retrieved. Forensics
tools such as ProDiscover Basic can retrieve deleted files for use as evidence.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
42
Chapter 1
Before beginning, extract all compressed files from the Chap01 folder
on the book’s DVD to your work folder.
In the following steps, you analyze George Montgomery’s USB drive. The first task is loading
the acquired image into ProDiscover Basic by following these steps:
1. Start ProDiscover Basic as you did in the previous activity.
2. To create a new case, click File, New Project from the menu.
3. In the New Project dialog box, type InChp01 in the Project Number text box and again
in the Project File Name text box (see Figure 1-16), and then click OK.
Figure 1-16 The New Project dialog box
Courtesy of Technology Pathways, LLC
4. In the tree view of the main window (see Figure 1-17), click to expand the Add item,
and then click Image File.
Figure 1-17 The tree view in ProDiscover
Courtesy of Technology Pathways, LLC
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Conducting an Investigation
43
5. In the Open dialog box, navigate to the folder containing the image, click the
InChp01-prac.eve file, and click Open. Click Yes in the Auto Image Checksum
message box, if necessary.
The next task is to display the contents of the acquired data. Perform the following steps:
1. In the tree view, click to expand Content View, if necessary. Click to expand Images,
and click the image filename path C:nWorknChap01nChapternInChp01-prac.eve
(substituting your folder path for Work—for example, C:nWorknChap01nChapter).
2. Next, click the + in front of the image file pathname, and then click All Files under
the image filename path. When the CAUTION dialog box opens, click Yes.
The InChp01-prac.eve file is then loaded in the main window, as shown
in Figure 1-18.
Figure 1-18 The loaded InChp01-prac.eve file
Courtesy of Technology Pathways, LLC
3. In the upper-right pane (the work area), click the letter1 file to view its contents in
the data area (see Figure 1-19).
4. In the data area, you see the contents of the letter1 file. Continue to navigate
through the work and data areas and inspect the contents of the recovered evidence.
Note that many of these files are deleted files that haven’t been overwritten. Leave
ProDiscover Basic running for the next activity.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
44
Chapter 1
Work area
Data area
Figure 1-19 Selecting a file in the work area and viewing its contents in the data area
Courtesy of Technology Pathways, LLC
The next step is analyzing the data and searching for information related to the complaint.
Data analysis can be the most time-consuming task, even when you know exactly what to
look for in the evidence. The method for locating evidentiary artifacts is to search for specific
known data values. Data values can be unique words or nonprintable characters, such as
hexadecimal codes. There are also printable character codes that can’t be generated from a
keyboard, such as the copyright (ª) or registered trademark (TM) symbols. Many digital forensics programs can search for character strings (letters and numbers) and hexadecimal values, such as A9 for the copyright symbol or AE for the registered trademark symbol. All
these searchable data values are referred to as “keywords.”
With ProDiscover Basic, you can search for keywords of interest in the case. For this case,
follow these steps to search for any reference to the name George:
1. In the tree view, click Search.
2. In the Search dialog box, click the Content Search tab, if necessary. Click the Select all
matches check box, the ASCII option button, and the Search for the pattern(s) option
button, if they aren’t already selected.
3. Next, in the text box under the Search for the pattern(s) option button, type George
(see Figure 1-20).
You can list keywords separately or combine words with the Boolean
logic operators AND, OR, and NOT. Searching for a common keyword
produces too many hits and makes it difficult to locate evidence of
interest to the case. Applying Boolean logic can help reduce unrelated
excessive hits, which are called “false-positive hits.”
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Conducting an Investigation
45
1
Figure 1-20 Entering a keyword in the Search dialog box
Courtesy of Technology Pathways, LLC
4. Under Select the Disk(s)/Image(s) you want to search in, click C:nWorknChap01n
ChapternInChp01-prac.eve (substituting the path to your work folder), and then click
OK to start the search. Leave ProDiscover Basic running for the next activity.
When the search is finished, ProDiscover displays the results in the search results pane in the
work area. Note the tabs labeled Search 1 and Search 2 in Figure 1-21. For each search you
do in a case, ProDiscover adds a new tab to help catalog your searches.
Click each file in the search results pane and examine its content in the data area. If you locate a
file of interest that displays binary (nonprintable) data in the data area, you can double-click the
file to display the data in the work area. Then you can double-click the file in the work area, and
an associated program, such as Microsoft Excel or LibreOffice for a spreadsheet, opens the file’s
content. If you want to extract the file, you can right-click it and click Copy File.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
46
Chapter 1
Figure 1-21 The search results pane
Courtesy of Technology Pathways, LLC
For this example, an Excel spreadsheet named Income.xls is displayed in the search results
pane. The information in the data area shows mostly unreadable character data. To examine
this data, you can export the data to a folder of your choice, and then open it for follow-up
examination and analysis. To export the Income.xls file, perform the following steps:
1. In the search results pane, double-click the Income.xls file, which switches the view
to the work area.
2. In the work area, right-click the Income.xls file and click Copy File.
3. In the Save As dialog box, navigate to the folder you’ve selected, and click Save.
4. Now that the Income.xls file has been copied to a Windows folder, start Excel (or
another spreadsheet program, such as LibreOffice Calc) to examine the file’s content.
Figure 1-22 shows the extracted file open in LibreOffice Calc. Repeat this data examination and file export process for the remaining files in the search results pane. Then
close all open windows except ProDiscover Basic for the next activity.
With ProDiscover’s Search feature, you can also search for specific filenames. To use this feature, click the “Search for files named” option button in the Search dialog box. When you’re
dealing with a very large drive with several thousand files, this useful feature minimizes
human error in looking at data.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Conducting an Investigation
47
1
Figure 1-22 The extracted spreadsheet file
Source: The Document Foundation
After completing the detailed examination and analysis, you can then generate a report of your
activities. Several digital forensics programs provide a report generator or log file of actions
taken during an examination. These reports and logs are typically text or HTML files. The text
files are usually in plaintext or Rich Text Format (RTF). ProDiscover Basic offers a report generator that produces an RTF or a plaintext file that most word processing programs can read.
You can also select specific items and add them to the report. For example, to select a file in the
work area, click the check box in the Select column next to the file to open the Add Comment
dialog box. Enter a description and click OK. The descriptive comment is then added to the
ProDiscover Basic report. To create a report in ProDiscover Basic, perform the following steps:
1. In the tree view, click Report. The report is then displayed in the right pane, as shown
in Figure 1-23.
2. To print the report, click File, Print Report from the menu.
3. In the Print dialog box, click OK.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
48
Chapter 1
Figure 1-23 A ProDiscover report
Courtesy of Technology Pathways, LLC
If the report needs to be saved to a file, you use ProDiscover Basic’s Export feature and
choose RTF or plaintext for the file format. To export the report to a file, do the following:
1. In the tree view, click Report.
2. Click Action, Export from the menu.
3. In the Export dialog box, click the RTF Format or Text Format option button, type
InChp01 in the File Name text box, and then click OK.
To place the report in a different folder, click the Browse button and
navigate to the folder where you want to save the report. Click Save,
and then click OK in the Export dialog box.
4. Review the report, and then click File, Exit from the menu to exit ProDiscover Basic.
This activity completes your analysis of the USB drive. In the next section, you learn how to complete the case. In later chapters, you learn how to apply more search and analysis techniques.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Conducting an Investigation
49
Completing the Case
After analyzing the disk, you can retrieve deleted files, e-mail, and items that have been purposefully hidden, which you do in Chapters 8, 9, and 11. The files on George’s USB drive
indicate that he was conducting a side business on his company computer. Now that you
have retrieved and analyzed the evidence, you need to find the answers to the following questions to write the final report:
•
How did George’s manager acquire the disk?
•
Did George perform the work on a laptop, which is his own property? If so, did he
conduct business transactions on his break or during his lunch hour?
•
At what times of the day was George using the non-work-related files? How did you
retrieve this information?
•
Which company policies apply?
•
Are there any other items that need to be considered?
When you write your report, state what you did and what you found. The report you generated in ProDiscover gives you an account of the steps you took. As part of your final report,
depending on guidance from management or legal counsel, include the ProDiscover report file
to document your work. In any computing investigation, you should be able to repeat the steps
you took and produce the same results. This capability is referred to as repeatable findings;
without it, your work product has no value as evidence.
Keep a written journal of everything you do. Your notes can be used in court, so be mindful
of what you write or e-mail, even to a fellow investigator. Often these journals start out as
handwritten notes, but you can transcribe them to electronic format periodically.
Basic report writing involves answering the six Ws: who, what, when, where, why, and how.
In addition to these basic facts, you must also explain computer and network processes. Typically, your reader is a senior personnel manager, a lawyer, or occasionally a judge who might
have little computer knowledge. Identify your reader and write the report for that person.
Provide explanations for processes and how systems and their components work.
Your organization might have templates to use when writing reports. Depending on your
organization’s needs and requirements, your report must describe the findings from your
analysis. The report generated by ProDiscover lists your examination and data recovery findings. Other digital forensics tools generate a log file of all actions taken during your examination and analysis. Integrating a digital forensics log report from these other tools can enhance
your final report. When describing the findings, consider writing your narrative first and then
placing the log output at the end of the report, with references to it in the main narrative.
Chapter 14 covers writing final reports for investigations in more detail.
In the Montgomery 72015 case, you want to show what evidence exists that George had his
own business registering domain names and list the names of his clients and his income from
this business. You also want to show letters he wrote to clients about their accounts. The time
and date stamps on the files are during work hours, so you should include this information,
too. Eventually, you hand the evidence file to your supervisor or to Steve, George’s manager,
who then decides on a course of action.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
50
Chapter 1
Critiquing the Case
After you close the case and make your final report, you need to meet with your department
or a group of fellow investigators and critique the case in an effort to improve your work.
Ask yourself assessment questions such as the following:
•
How could you improve your performance in the case?
•
Did you expect the results you found? Did the case develop in ways you did not
expect?
•
Was the documentation as thorough as it could have been?
•
What feedback has been received from the requesting source?
•
Did you discover any new problems? If so, what are they?
•
Did you use new techniques during the case or during research?
Make notes to yourself in your journal about techniques or processes that might need to be
changed or addressed in future investigations. Then store your journal in a secure place.
Chapter Summary
䊏
Digital forensics applies forensics procedures to digital evidence. This process involves
systematically accumulating and analyzing digital information for use as evidence in
civil, criminal, and administrative cases. Digital forensics differs from network forensics
and data recovery in scope, technique, and objective.
䊏
Laws relating to digital evidence were established in the 1970s.
䊏
To be a successful digital forensics investigator, you must be familiar with more than
one computing platform. To supplement your knowledge, develop and maintain contact with computer, network, and investigative professionals.
䊏
Investigators need specialized workstations to examine digital evidence, including additional bays for evidence drives, forensics software, and write blockers.
䊏
Public-sector and private-sector investigations differ, in that public-sector investigations
typically require a search warrant before seizing digital evidence. The Fourth Amendment to the U.S. Constitution and similar legislation in other countries apply to government search and seizure. During public-sector investigations, you search for evidence to
support criminal allegations. During private-sector investigations, you search for evidence to support allegations of policy violations, abuse of assets, and, in some cases,
criminal complaints.
䊏
Warning banners should be used to remind employees and visitors of company policy
on computer, e-mail, and Internet use.
䊏
Companies should define and limit the number of authorized requesters who can start
an investigation.
䊏
Digital forensics investigators must maintain professional conduct to protect their credibility.
䊏
Always use a systematic approach to your investigations. Follow the checklist in this
chapter as a guideline for your case.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Key Terms
51
䊏
When planning a case, take into account the nature of the case, instructions from the
requester, what additional tools and expertise you might need, and how you will acquire the evidence.
䊏
Criminal cases and company-policy violations should be handled in much the same
manner to ensure that quality evidence is presented. Both criminal cases and companypolicy violations can go to court.
䊏
When you begin a case, there might be unanticipated challenges that weren’t obvious
when applying a systematic approach to your investigation plan. For all investigations,
you need to plan for contingencies for any unexpected problems you might encounter.
䊏
You should create a standard evidence custody form to track the chain of custody of
evidence for your case. There are two types of forms: a multi-evidence form and a
single-evidence form.
䊏
Internet abuse investigations require examining server log data.
䊏
For attorney-client privilege cases, all written communication should have a header
label stating that it’s privileged communication and a confidential work product.
䊏
A bit-stream copy is a bit-by-bit duplicate of the original disk. You should use the
duplicate, whenever possible, when analyzing evidence.
䊏
Always maintain a journal to keep notes on exactly what you did when handling evidence.
䊏
You should always critique your own work to determine what improvements you
made during each case, what could have been done differently, and how to apply those
lessons to future cases.
Key Terms
affidavit A notarized document, given under penalty of perjury, that investigators create to
detail their findings. This document is often used to justify issuing a warrant or to deal with
abuse in a corporation. Also called a “declaration” when the document is unnotarized.
allegation A charge made against someone or something before proof has been found.
approved secure container A fireproof container locked by a key or combination.
attorney-client privilege (ACP) Communication between an attorney and client about legal
matters is protected as confidential communications. The purpose of having confidential
communications is to promote honest and open dialogue between an attorney and client.
This confidential information must not be shared with unauthorized people.
authorized requester In a private-sector environment, the person who has the right to
request an investigation, such as the chief security officer or chief intelligence officer.
bit-stream copy A bit-by-bit duplicate of data on the original storage medium. This process is
usually called “acquiring an image,” “making an image,” or “forensic copy.”
bit-stream image The file where the bit-stream copy is stored; usually referred to as an
“image,” “image save,” or “image file.”
chain of custody The route evidence takes from the time the investigator obtains it until the
case is closed or goes to court.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
52
Chapter 1
Computer Technology Investigators Network (CTIN) A nonprofit group based in Seattle-
Tacoma, WA, composed of law enforcement members, private corporation security
professionals, and other security professionals whose aim is to improve the quality of hightechnology investigations in the Pacific Northwest.
data recovery Retrieving files that were deleted accidentally or purposefully.
Digital Evidence First Responder (DEFR) A professional who secures digital evidence at the
scene and ensures its viability while transporting it to the lab.
Digital Evidence Specialist (DES) An expert who analyzes digital evidence and determines
whether additional specialists are needed.
digital forensics Applying investigative procedures for a legal purpose; involves the analysis
of digital evidence as well as obtaining search warrants, maintaining a chain of custody,
validating with mathematical hash functions, using validated tools, ensuring repeatability,
reporting, and presenting evidence as an expert witness.
digital investigations The process of conducting forensic analysis of systems suspected of
containing evidence related to an incident or a crime.
evidence bags Nonstatic bags used to transport computer components and other digital
devices.
evidence custody form A printed form indicating who has signed out and been in physical
possession of evidence.
exculpatory evidence Evidence that indicates the suspect is innocent of the crime.
exhibits Evidence used in court to prove a case.
forensic workstation A workstation set up to allow copying forensic evidence, whether it’s
on a hard drive, flash drive, or the cloud. It usually has software preloaded and ready to use.
Fourth Amendment The Fourth Amendment to the U.S. Constitution in the Bill of Rights
dictates that the government and its agents must have probable cause for search and seizure.
hostile work environment An environment in which employees cannot perform their
assigned duties because of the actions of others. In the workplace, these actions include
sending threatening or demeaning e-mail or a co-worker viewing pornographic or hate sites.
inculpatory evidence Evidence that indicates a suspect is guilty of the crime with which he or
she is charged.
industrial espionage Theft of company sensitive or proprietary company information often
to sell to a competitor.
International Association of Computer Investigative Specialists (IACIS) An organization
created to provide training and software for law enforcement in the digital forensics field.
interrogation The process of trying to get a suspect to confess to a specific incident or crime.
interview A conversation conducted to collect information from a witness or suspect about
specific facts related to an investigation.
line of authority The order in which people or positions are notified of a problem; these
people or positions have the legal right to initiate an investigation, take possession of
evidence, and have access to evidence.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Review Questions
53
multi-evidence form An evidence custody form used to list all items associated with a case.
See also evidence custody form.
network intrusion detection and incident response Detecting attacks from intruders by
using automated tools; also includes the manual process of monitoring network firewall logs.
professional conduct Behavior expected of an employee in the workplace or other
professional setting.
repeatable findings Being able to obtain the same results every time from a digital forensics
examination.
search and seizure The legal act of acquiring evidence for an investigation. See also Fourth
Amendment.
search warrants Legal documents that allow law enforcement to search an office, a home, or
other locale for evidence related to an alleged crime.
single-evidence form A form that dedicates a page for each item retrieved for a case. It
allows investigators to add more detail about exactly what was done to the evidence each
time it was taken from the storage locker. See also evidence custody form.
verdict The decision returned by a jury.
vulnerability/threat assessment and risk management The group that determines the
weakest points in a system. It covers physical security and the security of OSs and
applications.
warning banner Text displayed on computer screens when people log on to a company
computer; this text states ownership of the computer and specifies appropriate use of the
machine or Internet access.
Review Questions
1. Digital forensics and data recovery refer to the same activities. True or False?
2. Police in the United States must use procedures that adhere to which of the following?
a. Third Amendment
b.
Fourth Amendment
c.
First Amendment
d.
None of the above
3. The triad of computing security includes which of the following?
a. Detection, response, and monitoring
b.
Vulnerability assessment, detection, and monitoring
c.
Vulnerability/threat assessment and risk management, network intrusion detection
and incident response, and digital investigation
d.
Vulnerability assessment, intrusion response, and monitoring
4. What’s the purpose of maintaining a network of digital forensics specialists?
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
54
Chapter 1
5. Policies can address rules for which of the following?
a. When you can log on to a company network from home
b.
The Internet sites you can or can’t access
c.
The amount of personal e-mail you can send
d.
Any of the above
6. List two items that should appear on a warning banner.
7. Under normal circumstances, a private-sector investigator is considered an
agent of law enforcement. True or False?
8. List two types of digital investigations typically conducted in a business
environment.
9. What is professional conduct, and why is it important?
10. What’s the purpose of an affidavit?
11. What are the necessary components of a search warrant?
12. What are some ways to determine the resources needed for an investigation?
13. List three items that should be on an evidence custody form.
14. Why should you do a standard risk assessment to prepare for an investigation?
15. You should always prove the allegations made by the person who hired you.
True or False?
16. For digital evidence, an evidence bag is typically made of antistatic material.
True or False?
17. Why should evidence media be write-protected?
18. List three items that should be in your case report.
19. Why should you critique your case after it’s finished?
20. What do you call a list of people who have had physical possession of the
evidence?
21. Data collected before an attorney issues a memo for an attorney-client privilege case is protected under the confidential work product rule. True or False?
Hands-On Projects
In the following hands-on projects, continue to work at the workstation you
set up in this chapter. Extract the compressed files from the Chap01nProjects
folder on the book’s DVD to your WorknChap01nProjects folder. (If necessary, create this folder on your system to store your files.)
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
55
If needed, refer to the directions in this chapter and
the ProDiscover user manual, which is in C:nProgram
Filesx86nTechnology PathwaysnProDiscover by default.
Hands-On Project 1-1
The case in this project involves a suspicious death. Joshua Zarkan found his
girlfriend’s dead body in her apartment and reported it. The first responding
law enforcement officer seized a USB drive. A crime scene evidence technician
skilled in data acquisition made an image of the USB drive with ProDiscover
and named it C1Prj01.eve. Following the acquisition, the technician transported and secured the USB drive and placed it in a secure evidence locker at
the police station. You have received the image file from the detective assigned
to this case. He directs you to examine it and identify any evidentiary artifacts
that might relate to this case. To process this case, follow these steps to evaluate what’s on the image of the USB drive:
1. Start ProDiscover Basic. (If you’re using Windows Vista or later, right-click
the ProDiscover desktop icon and click Run as administrator.)
2. In the Launch Dialog dialog box, click the New Project tab, if necessary.
Enter a project number. If your company doesn’t have a standard numbering scheme, you can use the date followed by the number representing the
case that day in sequence, such as 20150124 01.
3. Enter C1Prj01 as the project name, enter a brief description of the case,
and then click Open.
4. To add an image file, click Action from the menu, point to Add, and click
Image File.
5. Navigate to your work folder, click C1Prj01.eve, and then click Open. If
the Auto Image Checksum message box opens, click Yes.
6. In the tree view, click to expand Content View. Click to expand Images,
and then click the pathname containing the image file. In the work area,
notice the files that are listed.
7. Right-click any file and click View to start the associated program, such as
Word or Excel. View the file, and then exit the program.
8. If you decide to export a file, right-click the file and click Copy File. (Note:
Creating a separate folder for exports is a good idea to keep your files
organized.) In the Save As dialog box that opens, navigate to the location
where you want to save the file, and then click Save.
9. To save the project to view later, click File, Save Project from the menu.
The default project name is the one you entered in Step 3. Select the drive
and folder (WorknChap01nProjects, for example), and then click Save.
After you have finished examining the files, exit ProDiscover Basic and save
the project again, if prompted.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
56
Chapter 1
You need to export any files in this image and give them to the investigator. In
addition, write a brief report (no more than two paragraphs) including any
facts from the contents of the recovered data.
In ProDiscover Basic, you must exit the program
before beginning a new case.
Hands-On Project 1-2
In this project, you work for a large corporation’s IT security company. Your
duties include conducting internal computing investigations and forensics examinations on company computing systems. A paralegal from the Law Department,
Ms. Jones, asks you to examine a USB drive belonging to an employee who left
the company and now works for a competitor. The Law Department is concerned that the former employee might possess sensitive company data. Ms.
Jones wants to know whether the USB drive contains anything significant.
In addition, she informs you that the former employee might have had
access to confidential documents because a co-worker saw him accessing his
manager’s computer on his last day of work. These confidential documents
consist of 24 files with the text “book.” She wants you to locate any occurrences of these files on the USB drive’s bit-stream image.
To process this case, make sure you have extracted the C1Prj02.eve file
to your work folder, and then follow these steps:
1. Start ProDiscover Basic. In the New Project tab, enter a project number,
the project name C1Prj02, and a project description, and then click Open.
It’s a good idea to get in the habit of saving the project immediately, so
click File, Save Project from the menu, and save the file in your work folder
(WorknChap01nProjects).
2. Click Action from the menu, point to Add, and click Image File. Navigate
to and click C1Prj02.eve in your work folder, and then click Open.
If the Auto Image Checksum message box opens, click Yes.
3. In the tree view, click to expand Content View, if necessary. Click to
expand Images, and then click the pathname containing the image file.
In the work area, examine the files that are listed.
4. To search for the keyword “book,” click the Search toolbar button to open
the Search dialog box.
5. If necessary, click the Content Search tab, and then click the ASCII option
button and the Search for the pattern(s) option button. Type book in the list
box for search keywords. Under Select the Disk(s)/Image(s) you want to search
in, click the drive you’re searching (see Figure 1-24), and then click OK.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
57
1
Figure 1-24 Entering search settings
Courtesy of Technology Pathways, LLC
6. In the tree view, click to expand Search Results, if necessary, and then
click Content Search Results to specify the type of search. Figure 1-25
shows the search results pane.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
58
Chapter 1
Figure 1-25 Viewing the search results
Courtesy of Technology Pathways, LLC
7. Next, open the Search dialog box again, click the Cluster Search tab, and
run the same search. Note that it takes longer because each cluster on the
drive is searched.
8. In the tree view, click Cluster Search Results, and view the search results
pane. Remember to save your project and exit ProDiscover Basic before
starting the next case.
When you’re finished, write a memo to Ms. Jones with the following information: the filenames in which you found a hit for the keyword and, if the hit
occurred in unallocated space, the cluster number.
Hands-On Project 1-3
Ms. Jones notifies you that the former employee has used an additional drive.
She asks you to examine this new drive to determine whether it contains an
account number the employee might have had access to. The account number,
461562, belongs to the senior vice president and is used to access the company’s banking service over the Internet.
1. Start ProDiscover Basic. In the New Project tab, enter a project number, the
project name C1Prj03, and a brief description, and then click Open. Save the
project in your work folder by clicking File, Save Project from the menu.
2. To add the evidence, click Action from the menu, point to Add, and click
Image File. Navigate to your work folder, click the C1Prj03.dd file, and
then click Open. Click Yes in the Auto Image Checksum message box, if
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
59
necessary. Notice that the image file is a .dd file, not an .eve file. Like
most forensics tools, ProDiscover can read standard UNIX .dd image files.
3. To aid in your investigation, you might want to view graphics files on the
drive. To do this, click to expand Content View in the tree view, click to
expand Images, and then click the pathname containing the image file.
4. Click View, Gallery View from the menu. Scroll through the graphics files
on the drive image. You’ll need to search through all folders, which can
take some time. If a file is of interest, click the check box next to it in the
Select column. In the Add Comment dialog box that opens, enter a description and click OK. These notes are added to the ProDiscover report.
5. This drive is related to the case in Hands-On Project 1-2, so you’re still looking
for occurrences of the word “book.” Open the Search dialog box, and repeat
Steps 5 through 8 of Hands-On Project 1-2 for this drive image. When you
view the search results, click to select any files of interest (as described in Step
4), which opens the Add Comment dialog box where you can enter notes.
6. Next, search for the account number Ms. Jones gave you. Click the Search
toolbar button. Click the Content Search tab, if necessary, and type
461562 as the search keyword. Click to select the drive you’re searching,
and then click OK. Click the Cluster Search tab, and repeat the search for
the account number. Remember to select any files of interest and enter
notes in the Add Comment dialog box.
Remember that text can be found in graphics files as well as in documents. If your search results produces no findings, you might have to
search graphics and picture files separately for evidence.
7. When you’re finished, click Report in the tree view. Scroll through the
report to make sure all the items you found are listed.
8. Next, click the Export toolbar button. In the Export dialog box, click the
RTF Format option button, type Ch1Prj03Report in the File Name text
box, and then click OK. (If you want to store the report in a different
folder, click Browse and navigate to the new location.)
9. Write a short memo to summarize what you found. Save the project and
exit ProDiscover Basic.
Hands-On Project 1-4
Sometimes discovery demands from law firms require you to recover only allocated data from a disk. This project shows you how to extract just the files that
haven’t been deleted from an image.
1. Start ProDiscover Basic. In the New Project tab, enter a project number, a
brief description, and the project name C1Prj04, and then click Open.
2. In the tree view, click to expand Add, and then click Image File. Navigate
to your work folder, click the C1Prj04.eve file, and then click Open.
Click Yes in the Auto Image Checksum message box, if necessary. Save the
project in your work folder.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
1
60
Chapter 1
3. In the tree view, click to expand Content View, if necessary. Click to
expand Images, and then click the pathname containing the image file.
Notice the files displayed in the work area.
4. Click the column header Deleted to sort the files into YES and NO groups
(see Figure 1-26).
Figure 1-26 Deleted files displayed in the work area
Courtesy of Technology Pathways, LLC
5. To extract the allocated files from the image to your work folder, rightclick each file containing NO in the Deleted column and click Copy File.
(Note that in ProDiscover Basic, there’s no way to select multiple files at
once. You must copy each allocated file separately.) When you’re finished,
save the project and exit ProDiscover Basic.
Hands-On Project 1-5
This project is a continuation from the previous project; you’ll create a report
listing all the unallocated (deleted) files ProDiscover finds.
1. Start ProDiscover Basic. Click the Open Project tab, and navigate to your
work folder.
2. Click the C1Prj04.dft file and click Open. Click Yes in the Auto Image
Checksum message box, if necessary.
3. If necessary, sort the files in the work area again by clicking the Deleted
column header. Click the check box in the Select column next to all
unallocated (deleted) files, as shown in Figure 1-27. As you click each
check box, the Add Comment dialog box opens, where you can enter a
description of each file.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
61
1
Figure 1-27 Selecting a file to include in a report
Courtesy of Technology Pathways, LLC
4. In the Investigator comments text box, add a comment noting that the file
is deleted and indicating its file type, such as a Word document or an image
file (.jpeg or .gif, for instance). Be sure to enter something meaningful
by examining the file first.
5. When you’re finished, click Report in the tree view. If you’re satisfied, export
the report by clicking the Export toolbar button. In the Export dialog box,
select the format option you want, type C1Prj05Report in the File Name text
box, and then click OK. Save the project and exit ProDiscover Basic.
Hands-On Project 1-6
In this project, another investigator asks you to examine an image and search
for all occurrences of the following keywords:
• ANTONIO
• HUGH EVANS
• HORATIO
1. Start ProDiscover Basic. In the New Project tab, enter a project number, a
brief description, and the project name, and then click Open.
2. In the tree view, click to expand Add, and click Image File. Navigate to
your work folder, click the C1Prj06.eve file, and click Open. Click Yes
in the Auto Image Checksum message box, if necessary. Save the project in
your work folder.
3. Click the Search toolbar button. In the Search dialog box, type all keywords in the list box (placing each on a separate line), click to select the
drive containing the image, and click OK.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
62
Chapter 1
4. Examine the files in the search results pane. Select the ones that look interesting and enter notes in the Add Comment dialog box.
5. Generate a report and export it, as explained in previous projects. Save the
project and exit ProDiscover Basic.
Case Projects
Case Project 1-1
An insurance company has asked your digital forensics firm to review a case for
an arson investigation. The suspected arsonist has already been arrested, but the
insurance company wants to determine whether there’s any contributory negligence on the part of the victims. Two files were extracted to your work folder
for this project. The first, Chap01 CasePrj01a.doc, is a memo about the case
from the police department. The second, Chap01 CasePrj01b.doc, is a letter
from the insurance company explaining what should be investigated. Review
these files, and decide the course of action your firm needs to take. Write an outline for how your firm should approach the case.
Case Project 1-2
Jonathan Simpson owns a construction company. One day a subcontractor
calls him, saying that he needs a replacement check for the job he completed at
1437 West Maple Avenue. Jonathan looks up the job on his accounting program and agrees to reissue the check for $12,750. The subcontractor says that
the original check was for only $10,750. Jonathan looks around the office but
can’t find the company checkbook or ledger. Only one other person has access
to the accounting program. Jonathan calls you to investigate. How would you
proceed? Write a one-page report detailing the steps Jonathan needs to take to
gather the necessary evidence and protect his company.
Case Project 1-3
You are the digital forensics investigator for a law firm. The firm acquired a
new client, a young woman who was fired from her job for inappropriate files
discovered on her computer. She swears she never accessed the files. What
questions should you ask and how should you proceed? Write a one- to twopage report describing the computer the client used, who else had access to it,
and any other relevant facts that should be investigated.
Case Project 1-4
A desperate employee calls because she has accidentally deleted crucial files from
her hard drive and can’t retrieve them from the Recycle Bin. What are your
options? Write one to two pages explaining your capabilities and listing the
questions you need to ask her about her system.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
chapter
2
The Investigator’s Office
and Laboratory
After reading this chapter and completing
the exercises, you will be able to:
• Describe certification requirements for digital forensics labs
• List physical requirements for a digital forensics lab
• Explain the criteria for selecting a basic forensic workstation
• Describe components used to build a business case for developing a
forensics lab
63
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
64
Chapter 2
This chapter explains some options for setting up an effective digital forensics laboratory.
Each digital forensics investigator in a lab should also have a private office where he or she
can manage cases, conduct interviews, and communicate without eavesdropping concerns.
Whether you’re new to digital forensics or are an experienced examiner, your goal is to make
your office and lab work smoothly and efficiently for all casework.
Digital forensics investigators must remember to consider budget and time when updating
their labs to keep pace with computer technology changes. The workflow and processes you
establish directly affect the quality of evidence you discover. You must balance cost, quality,
and reliability when determining the kind of equipment, software, and other items you need
to add to your lab. This chapter provides a foundation for organizing, controlling, and managing a safe, efficient forensics laboratory.
Understanding Forensics Lab Accreditation Requirements
A digital forensics lab is where you conduct investigations, store evidence, and do most of
your work. You use the lab to house your instruments, current and legacy software, and forensic workstations. In general, you need a variety of digital forensics hardware and software
to do your work.
You also need to make sure you have defined policies, processes, and prescribed procedures
before beginning any casework to ensure the integrity of an analysis and its results. A number
of organizations have created guidelines for devising your own processes and procedures.
What’s most important is that you follow the policies and procedures you have created to
ensure consistency in your output. Checklists are a good way to ensure consistent methods of
operations for staff.
Be sure to research accrediting bodies thoroughly before pursuing any
accreditation. Many accreditations are offered by software vendors;
others are specific for law enforcement or started by local groups.
The American Society of Crime Laboratory Directors (ASCLD; www.ascld.org) provides guidelines to members for managing a forensics lab and acquiring crime and forensics lab accreditation. ASCLD also accredits forensics labs that analyze digital evidence as they do other criminal
evidence, such as fingerprints and DNA samples. This accreditation is based on the original
crime lab accreditation, ASCLD/LAB (www.ascld-lab.org), which regulates how crime labs are
organized and managed. The ASCLD/LAB program includes specific audits on all functions to
ensure that lab procedures are being performed correctly and consistently for all casework.
These audits should be conducted in forensics labs to maintain the quality and integrity of analysis. The following sections discuss several key guidelines from the ASCLD/LAB program that
you can apply to managing, configuring, and auditing your forensics lab. For additional information on how ASCLD conforms to an international standard, see ISO/IEC 17025:2005.
Identifying Duties of the Lab Manager and Staff
The ASCLD states that each lab should have specific objectives that a parent organization and
the lab’s director or manager have determined. The lab manager sets up processes for managing cases and reviews them regularly. Besides performing general management tasks, such as
promoting group consensus in decision making, maintaining fiscal responsibility for lab needs,
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding Forensics Lab Accreditation Requirements
65
and enforcing ethical standards (covered in Chapters 15 and 16) among staff members, the lab
manager plans updates for the lab, such as new hardware and software purchases.
The lab manager also establishes and promotes quality assurance processes for the lab’s staff
to follow, such as outlining what to do when a case arrives, logging evidence, specifying who
can enter the lab, and establishing guidelines for filing reports. To ensure the lab’s efficiency,
the lab manager also sets reasonable production schedules for processing work.
A typical investigation involves seizing a hard disk and other media, such as smartphones;
making forensic copies of them; evaluating evidence; and filing a report. A forensics analysis
of a 2 TB disk, for example, can take several days and often involves running imaging software overnight and on weekends. This means one of the forensic workstations in the lab is
occupied for that time, which can be 20 hours or more. Based on past experience, the lab
manager can estimate how many cases each investigator can handle and when to expect a
preliminary and final report for each case.
The lab manager creates and monitors lab policies for staff and provides a safe and secure
workplace for staff and evidence. Above all, the lab manager accounts for all activities the
lab’s staff conducts to complete its work. Tracking cases such as e-mail abuse, Internet misuse, and illicit activities can justify the funds spent on a lab.
Staff members in a forensics lab should have enough training to perform their tasks. Necessary skills include hardware and software knowledge, including OS and file types, and deductive reasoning. Their work is reviewed regularly by the lab manager and their peers to ensure
quality. Staff members are also responsible for continuing technical training to update their
investigative and computer skills and maintaining a record of the training they have completed. Many vendors and organizations hold annual or quarterly training seminars that offer
certification exams.
The ASCLD Web site summarizes the requirements of managing a digital forensics lab, handling and preserving evidence, performing laboratory procedures, setting personnel requirements, and encouraging professional development. The site also provides a user license for
printed and online manuals of lab management guidelines. ASCLD stresses that each lab
should maintain an up-to-date library of resources in its field. For digital forensics, these
resources include software, hardware information, and technical journals.
Lab Budget Planning
To conduct a professional computing investigation, you need to understand the cost of your
lab operation. Lab costs can be broken down into monthly, quarterly, and annual expenses.
The better you understand these expenses, the better you can delegate resources for each
investigation. Using a spreadsheet program helps you keep track of past investigation
expenses so that you can extrapolate expected future costs. Remember that expenses include
purchasing computer hardware and software, renting facility space, and training personnel.
When creating a budget, start by estimating the number of cases your lab expects to examine
and identifying the types of computers you’re likely to examine, such as Windows PCs, Apple
systems, or Linux workstations. For example, suppose you work for a state police agency
that’s planning to provide computing investigation services for the entire state. You could
start by collecting state crime statistics for the current year and several previous years to
determine types of computers or other devices associated with these crimes. Criminal behavior often reflects sales trends for certain computing systems. Because more than 90% of consumers use Intel and AMD PCs, and 90% of these computers run Windows, the same
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
2
66
Chapter 2
statistics are likely true of computers used in crimes. Verify this trend by determining how often each type of system is used in a crime. List the number of crimes committed that involve
DOS/Windows, Linux/UNIX, and Apple computers.
If you can’t find detailed information on the types of computers and OSs used in computer
crimes, gather enough information to make an educated guess. Your goal is to build a baseline for the types and numbers of systems you can expect to investigate. In addition to the historical data you compile, identify any future trends that could affect your lab, such as a new
version of an OS or an increase in the number of computers involved in crime.
Next, estimate how many investigations you might conduct involving computer systems used
less often to help determine how many tools you need to examine these systems. For example,
if you learn that on average, one Macintosh is involved in a criminal investigation each
month, you probably need only one or two software tools to conduct a forensic analysis on
Macintosh file systems.
Figure 2-1 shows a table of statistics from a Uniform Crime Report that identifies the number
of hard disk types, such as SATA or SCSI, and the OS used to commit crimes. Annual
Figure 2-1 Uniform Crime Report statistics
ª 2016 Cengage Learningâ
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding Forensics Lab Accreditation Requirements
67
Uniform Crime Reports are generated at the federal, state, and local levels to show the types
and frequency of crimes committed. For federal reports, see www.fbi.gov/ucr/ucr.htm, and
for a summary of crimes committed at different levels, see www.bjs.gov.
You can also identify specialized software used with certain crimes. For example, if you find
a check-writing software tool used in a large number of counterfeiting cases, you should consider adding this specialized software to your inventory.
If you’re preparing to set up a forensics lab for a private company, you can determine your
needs more easily because you’re working in a contained environment. Start by getting an inventory of all known computing systems and applications used in the business. For example,
an insurance company often has a network of Intel PCs and servers and specialized insurance
software using a database for data storage. A large manufacturing company might use Intel
PCs, UNIX workstations running a computer-aided design (CAD) system, super minicomputers, and mainframes. A publishing company might have a combination of Intel PCs and
Macintosh systems and a variety of word processing, imaging, and composition packages.
Many other organizations use cloud-based storage or supervisory control and data acquisition (SCADA) systems for data and applications.
Next, check with your Management, Human Resource, and Security departments to
determine the types of complaints and problems reported in the past year. Most companies
using Internet connections, for example, receive complaints about employees accessing the
Web excessively or for personal use, which generate investigations of Web misuse. Be sure to
distinguish investigations of excessive Web use from inappropriate Web site access and e-mail
harassment.
Your budget should also take future developments in computing technology into account
because drive storage capabilities improve constantly. When examining a disk, you need a
target disk to which you copy evidence data. This disk should be at least one and a half
times the size of the evidence (suspect) disk. For example, a lab equipped with 4 TB disks
can effectively analyze disks up to 3 TB. If your company upgrades its computers to 1 TB
disks, however, you need disks that are 2 TB or more or a central secure server with at
least 100 TB or more of storage. (Several forensic servers on the market are in the 32 TB
and higher range.) Many businesses replace their desktop computer systems every 18
months to three years. You must be informed of computer upgrades and other changes in
the computing environment so that you can prepare and submit your budget for needed
resources.
Like computer hardware, OSs change periodically. If your current digital forensics tool
doesn’t work with the next release of a Microsoft OS or file system, you must upgrade
your software tools. You should also monitor or contact vendor product development
teams to learn about upgrades. File systems change, too. Forensics tools had their birth in
DOS, and over the years, Windows hard disks used a variety of file systems, including
FAT16, FAT32, New Technology File System (NTFS), Resilient File System (ReFS), and
other Windows file systems. Most DOS-based tools can’t read NTFS disks. In addition, the
popularity and prevalence of the Xbox requires investigators to be familiar with the FATX
file system.
Time management is a major issue when choosing software and hardware to purchase. For
example, you’ve decided to purchase eight machines for your lab. Many commercial forensics
software packages require a USB dongle to operate or have a site license of five concurrent
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
2
68
Chapter 2
users. You or the budget manager must decide whether you’re using all the machines or need
only two licensed copies of each software package. As another example, you can have a
command-line tool running overnight for drive imaging; while it’s running; investigators can
use a commercial or freeware package to evaluate a drive. Your choices depend on what tools
you have verified and what’s needed for your casework.
Another option for viewing file systems is to use a Linux Live CD or WinFE (modified version
of WinPE, the automated installation kit), which are CD or DVD disk acquisition tools discussed in Chapter 3. It doesn’t mount the hard drive automatically and, therefore, doesn’t
write to the drive. (A hardware write-blocker is still recommended to prevent errors caused
by the forensics technician, if nothing else.) Examining tablets, USB drives, and smartphones
is routine now in cases from criminal investigations to civil litigation discovery demands. Digital investigators must be prepared to deal with constant change in these devices and know
what tools are available to extract data from them safely for an investigation. In Chapter 12,
you learn how to acquire data from these devices.
Acquiring Certification and Training
To continue a career in computing investigations and forensic analysis, you need to upgrade
your skills through training. Several organizations have developed or are currently developing
certification programs for digital forensics that usually test you after you have completed one
or more training sessions successfully. Certifying organizations range from nonprofit associations to vendor-sponsored groups. All these programs charge fees for certification, and some
require candidates to take vendor- or organization-sponsored training to qualify for the
certification. Some U.S. state legislatures now require digital forensics examiners working in
a private practice or business to have a private investigator’s license. These states typically
require some level of training and certification in both digital forensics and investigations
before applying for a license.
Before enlisting in a certification program, thoroughly research the requirements, cost, and
acceptability in your area of employment. Most certification programs require continuing
education credits or reexamination of candidates’ skills, which can become costly.
International Association of Computer Investigative Specialists
Created by police officers who wanted to formalize credentials in computing investigations, the International Association of Computer Investigative Specialists (IACIS) is one of
the oldest professional digital forensics organizations. It restricts membership to sworn
law enforcement personnel or government employees working as forensic examiners.
This restriction might change, so visit the IACIS Web site (www.iacis.com) to verify the
requirements.
Candidates who complete the IACIS test successfully are designated as a Certified Forensic
Computer Examiner (CFCE). The CFCE process changes as technology changes. The
description here is current as of this writing. IACIS requires recertification every three years
to demonstrate continuing work in the field of digital forensics. Recertification is less intense
than the original certification but does test examiners to make sure they’re continuing their
education and are still active in the field of digital forensics. For the latest information about
IACIS and applying for CFCE certification or membership in IACIS, visit the IACIS
Web site.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding Forensics Lab Accreditation Requirements
69
ISC 2 Certified Cyber Forensics Professional The Certified Cyber Forensics
Professional (CCFP) program, sponsored by ISC2, requires knowledge of digital forensics,
malware analysis, incident response, e-discovery, and other disciplines related to cyber
investigations. The CCFP Web site (www.isc2.org/ccfp/Default.aspx) lists requirements and
processes needed for this certification.
High Tech Crime Network The High Tech Crime Network (HTCN) also offers
several levels of certification. Unlike IACIS, however, HTCN requires a review of all related
training, including training in one of its approved courses, and a review of the candidate’s
work history. HTCN certification is open to anyone meeting the criteria in the profession of
computing investigations. At the time of this writing, the HTCN Web site (www.htcn.org)
specifies requirements for the certification levels discussed in the following paragraphs.
Requirements are updated without notice, so make sure you check the site periodically.
Certified Computer Crime Investigator, Basic Level
• Candidates must have three years of experience directly related to investigating
computer-related incidents or crimes.
•
Candidates have successfully completed 40 hours of training from an approved agency,
organization, or training company.
•
Candidates must provide documentation of at least 10 cases in which they participated.
Certified Computer Crime Investigator, Advanced Level
•
Candidates must have five years of experience directly related to investigating
computer-related incidents or crimes.
•
Candidates have successfully completed 80 hours of training from an approved agency,
organization, or company.
•
Candidates have served as lead investigator in at least 20 cases during the past three
years and were involved in at least 40 other cases as a lead investigator or supervisor
or in a supportive capacity. Candidates have at least 60 hours of involvement in cases
in the past three years.
Certified Computer Forensic Technician, Basic
•
Candidates must have three years of experience in computing investigations for law
enforcement or corporate cases.
•
Candidates must have completed 40 hours of computer forensics training from an
approved organization.
•
Candidates must provide documentation of at least 10 computing investigations.
Certified Computer Forensic Technician, Advanced
•
Candidates must have five years of hands-on experience in computer forensics
investigations for law enforcement or corporate cases.
•
Candidates must have completed 80 hours of computer forensics training from an
approved organization.
•
Candidates must have been the lead computer forensics investigator in 20 or more
investigations in the past three years and in 40 or more additional computing
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
2
70
Chapter 2
investigations as lead computer forensics technician, supervisor, or contributor. The
candidate must have completed at least 60 investigations in the past three years.
EnCase Certified Examiner Certification Guidance Software, the creator of
EnCase, sponsors the EnCase Certified Examiner (EnCE) certification program. EnCE certification is open to the public and private sectors and is specific to use and mastery of EnCase
forensics analysis. Requirements for taking the EnCE certification exam don’t depend on taking the Guidance Software EnCase training courses. Candidates for this certificate are
required to have a licensed copy of EnCase. For more information on EnCE certification
requirements, visit www.encase.com.
AccessData Certified Examiner AccessData sponsors the AccessData Certified Examiner (ACE) certification program. ACE certification is open to the public and private sectors
and is specific to use and mastery of AccessData Ultimate Toolkit. To help prepare for the
ACE exam, applicants can attend the AccessData BootCamp and Windows forensics courses.
The exam has a knowledge base assessment (KBA) and a practical skills assessment (PSA). For
more information on this certification, visit www.accessdata.com/acepreparation.html.
Other Training and Certifications The following are other organizations to consider for certification or training:
•
EC-Council, www.eccouncil.org/Certification
•
SysAdmin, Audit, Network, Security (SANS) Institute, www.sans.org or http://
computer-forensics.sans.org/training#408
•
Defense Cyber Investigations Training Academy (DCITA), www.dcita.edu
•
International Society of Forensic Computer Examiners (ISFCE, www.isfce.com) for the
Certified Computer Examiner (CCE) certification
•
High Tech Crime Consortium, www.hightechcrimecops.org
•
Computer Technology Investigators Network (CTIN), www.ctin.org
•
Digital Forensics Certification Board (DFCB), www.dfcb.org
•
Consortium of Digital Forensics Specialists (CDFS), www.cdfs.org
Organizations that offer training and certification for law enforcement personnel or qualified
civilian government personnel include the following:
•
Federal Law Enforcement Training Centers (FLETC), www.fletc.gov
•
National White Collar Crime Center (NW3C), www.nw3c.org
Determining the Physical Requirements for a Digital
Forensics Lab
After you have the training to become a digital forensics investigator, you conduct most of
your investigations in a lab. This section discusses the physical requirements for a forensics
lab. Addressing these requirements can make a lab safer, more secure, and more productive.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Determining the Physical Requirements for a Digital Forensics Lab
71
Your lab facility must be physically secure so that evidence isn’t lost, corrupted, or destroyed. As
with hardware and software costs, you must consider what’s needed to maintain a safe and secure
environment when determining physical lab expenses. You must also use inventory control methods to track your computing assets, which means you should maintain a complete and up-to-date
inventory of all major hardware and software items in the lab. For consumable items, such as
cables and storage media, maintain an inventory so that you know when to order more supplies.
Identifying Lab Security Needs
All digital forensics labs need an enclosed room where a forensic workstation can be set up.
You shouldn’t use an open cubicle because it allows easy access to your evidence. You need a
room you can lock to control your evidence and attest to its integrity. In particular, your lab
should be secure during data analysis, even if it takes several weeks to analyze a disk drive.
To preserve the integrity of evidence, your lab should function as an evidence locker or safe,
making it a secure facility or a secure storage safe.
The following are the minimum requirements for a digital forensics lab of any size:
•
Small room with true floor-to-ceiling walls
•
Door access with a locking mechanism, which can be a regular key lock, combination
lock, or an electronic lock capable of logging who accessed it; the key or combination
must be limited to authorized users, including cleaning crews
•
Secure container, such as a safe or heavy-duty file cabinet with a quality padlock that
prevents drawers from opening
•
Visitor’s log with legible entries listing all people who have accessed the lab and
showing the date, time in, and time out
For daily work production, several examiners can work together in a large open area, as long
as they all have the same level of authority and access need. This area should also have floorto-ceiling walls and a locking door. In many public and private organizations, several investigators share a door to the lab that requires an ID card and entry code.
Computing investigators and forensics examiners must be briefed on the lab’s security policy.
Share information about a case investigation only with other examiners and personnel who
need to know about the investigation.
Conducting High-Risk Investigations
High-risk investigations, such as those involving national security or murder, for example,
demand more security than the minimum lab requirements provide. As technology improves
and information circulates among computer attackers, keeping an investigation secure can be
more difficult. For example, detecting computer eavesdropping is difficult and expensive, but
sophisticated criminals and intelligence services in foreign countries can use equipment
that detects network transmissions, wireless devices, phone conversations, and the use of
computer equipment. Instructions for building a sniffing device that can collect computer
emanations illegally can be found online and, therefore, are available to anyone. These devices can pick up anything you type on your computer.
Most electronic devices emit electromagnetic radiation (EMR). Certain kinds of equipment
can intercept EMR, which can be used to determine the data the device is transmitting or
displaying. The EMR from a computer monitor can be picked up as far away as a half mile.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
2
72
Chapter 2
During the Cold War, defense contractors were required to shield sensitive computing systems
and prevent electronic eavesdropping of any computer emissions. The U.S. Department of
Defense calls this special computer-emission shielding TEMPEST. (For a brief description of
TEMPEST, see the National Industrial Security Program Operating Manual [NISPOM]. DoD
5220.22-M, Chapter 11, Section 1, TEMPEST, www.dss.mil/documents/odaa/nispom20065220.pdf. Another site listing reliable sources is www.jammed.com/jwa/tempest.html.)
To protect your investigations, you might consider constructing a TEMPEST-qualified lab,
which requires lining the walls, ceiling, floor, and doors with specially grounded conductive
metal sheets. Typically, copper sheeting is used because it conducts electricity well. TEMPEST
facilities must include special filters for electrical power that prevent power cables from
transmitting computer emanations. All heating and ventilation ducts must have special baffles
to trap emanations. Likewise, telephones inside the TEMPEST facility must have special line
filters. A TEMPEST facility usually has two doors separated by dead space. The first exterior
door must be shut before opening the interior door. Each door also has special copper
molding to enhance electricity conduction.
Because a TEMPEST-qualified lab facility is expensive and requires routine inspection and
testing, it should be considered only for large regional digital forensics labs that demand
absolute security from illegal eavesdropping. To avoid these costs, some vendors have built
low-emanating workstations instead of TEMPEST facilities. These workstations are more expensive than average workstations but less expensive than a TEMPEST lab.
Using Evidence Containers
Evidence storage containers, also known as evidence lockers, must be secure so that no unauthorized person can access your evidence easily. You must use high-quality locks, such as
padlocks, with limited duplicate-key distribution. Also, routinely inspect the contents of evidence storage containers to make sure only current evidence is stored. The evidence custody
forms should indicate what’s still in the locker. Evidence for closed cases should be moved to
a secure off-site facility.
Chapter 5, Section 3, of the NISPOM (www.dss.mil/documents/odaa/nispom2006-5220.pdf)
describes the characteristics of a safe storage container. Consult with your facility management or legal counsel, such as corporate or prosecuting attorneys, to determine what your
lab should do to maintain evidence integrity. The following are recommendations for securing storage containers:
•
The evidence container should be located in a restricted area that’s accessible only to
lab personnel.
•
The number of people authorized to open the evidence container should be kept to a
minimum. Maintain records on who’s authorized to access each container.
•
All evidence containers should remain locked when they aren’t under the direct supervision of an authorized person.
If a combination locking system is used for your evidence container, follow these practices:
•
Provide the same level of security for the combination as for the container’s contents.
Store the combination in another equally secure container.
•
Destroy any previous combinations after setting up a new combination.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Determining the Physical Requirements for a Digital Forensics Lab
73
•
Allow only authorized personnel to change lock combinations.
•
Change the combination every six months, when any authorized personnel leave the
organization, and immediately after finding an unsecured container—that is, one that’s
open and unattended.
If you’re using a keyed padlock, follow these practices:
•
Appoint a key custodian who’s responsible for distributing keys.
•
Stamp sequential numbers on each duplicate key.
•
Maintain a registry listing which key is assigned to which authorized person.
•
Conduct a monthly audit to ensure that no authorized person has lost a key.
•
Take an inventory of all keys when the custodian changes.
•
Place keys in a lockable container accessible only to the lab manager and designated
key custodian.
•
Maintain the same level of security for keys as for evidence containers.
•
Change locks and keys annually; if a key is missing, replace all associated locks and
the key.
•
Do not use a master key for several locks.
The storage container or cabinet should be made of steel and include an internal cabinet lock
or external padlock. If possible, purchase a safe, which provides superior security and protects your evidence from fire damage. Look for specialized safes, called media safes, designed
to protect electronic media. Media safes are rated by the number of hours it takes before fire
damages the contents. The higher the rating, the better the safe protects evidence.
An evidence storage room is also convenient, especially if it’s part of your forensics lab. Security for an evidence room must integrate the same construction and securing devices as the
general lab does. Large digital forensics operations also need an evidence custodian and a
service counter with a securable metal roll-up window to control evidence. With a secure evidence room, you can store large computer components, such as computers, monitors, and
other peripheral devices.
Be sure to maintain a log listing every time an evidence container is opened and closed. Each
time the container is accessed, the log should indicate the date it was opened and the initials
of the authorized person. These records should be maintained for at least three years or longer, as prescribed by your prosecuting or corporate attorneys. Logs are discussed in more
detail in Chapter 4.
Overseeing Facility Maintenance
Your lab should be maintained at all times to ensure the safety and health of lab personnel.
Any damage to the floor, walls, ceilings, or furniture should be repaired immediately. Also,
be sure to escort cleaning crews into the facility and monitor them as they work.
Because static electricity is a major problem when handling computer parts, consider placing
antistatic pads around electronic workbenches and workstations. In addition, floors and
carpets should be cleaned at least once a week to help minimize dust that can cause static
electricity.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
2
74
Chapter 2
Maintain two separate trash containers, one to store items unrelated to an investigation, such
as discarded CDs, and the other for sensitive material that requires special handling to make
sure it’s destroyed. Using separate trash containers maintains the integrity of criminal investigation processes and protects trade secrets and attorney-client privileged communication in a
private corporation. Several commercially bonded firms specialize in disposing of sensitive
materials, and you should hire one to help maintain the integrity of your investigations.
Considering Physical Security Needs
In addition to your lab’s physical design and construction, you need to enhance security by setting
security policies. How much physical security you implement depends on the nature of your lab.
A regional computer crime lab has high physical security needs because of the risks of losing, corrupting, or damaging evidence. The physical security needs of a large corporation are probably
not as high because the risk of evidence loss or compromise is much lower. Determining the risk
for your organization dictates how much security you integrate into your digital forensics lab.
When considering digital security needs, many companies neglect
physical security.
Regardless of the security risk to your lab, maintain a paper or electronic sign-in log for all
visitors. The log should list the visitor’s name, date and time of arrival and departure,
employer’s name, purpose of the visit, and name of the lab member receiving the visitor.
Consider anyone who’s not assigned to the lab to be a visitor, including cleaning crews,
facility maintenance personnel, friends, and family. All visitors should be escorted by an
assigned authorized staff member throughout their visit to the lab to ensure that they don’t
accidentally or intentionally tamper with an investigation or evidence. As an added precaution, use a visible or audible alarm, such as a visitor badge, to let all investigators know that
a visitor is in the area. If possible, hire a security guard or have an intrusion alarm system
with a guard to ensure your lab’s security. Alarm systems with guards can also be used after
business hours to monitor your lab.
Auditing a Digital Forensics Lab
To make sure security policies and practices are followed, conduct routine inspections to
audit your lab and evidence storage containers. Audits should include, but aren’t limited to,
the following facility components and practices:
•
Inspect the lab’s ceiling, floor, roof, and exterior walls at least once a month, looking
for anything unusual or new.
•
Inspect doors to make sure they close and lock correctly.
•
Check locks to see whether they need to be replaced or changed.
•
Review visitor logs to see whether they’re being used properly.
•
Review log sheets for evidence containers to determine when they have been opened
and closed.
•
At the end of every workday, secure any evidence that’s not being processed on a
forensic workstation.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Determining the Physical Requirements for a Digital Forensics Lab
75
Determining Floor Plans for Digital Forensics Labs
How you configure the work area for your digital forensics lab depends on your budget, the
amount of available floor space, and the number of computers you assign to each computing
investigator. For a small operation handling two or three cases a month, one forensic workstation should be enough to handle the workload. One workstation requires only the space
an average desk takes up. If you’re handling many more cases per month, you can probably
process two or three investigations at a time, which requires more than one workstation. The
ideal configuration for multiple workstations is to have two forensic workstations plus one
non-forensic workstation with Internet access.
Because you need plenty of room around each workstation, a work area containing three
workstations requires approximately 150 square feet of space, meaning the work area should
be about 10 feet by 15 feet. This amount of space allows for two chairs so that the computing
investigator can brief another investigator, paralegal, or attorney on the case.
Small labs usually consist of one or two forensic workstations, a research computer with
Internet access, a workbench (if space allows), and storage cabinets, as shown in Figure 2-2.
Figure 2-2 Small or home-based lab
ª Cengage Learningâ
Mid-size digital forensics labs, such as those in a private business, have more workstations.
For safety reasons, the lab should have at least two exits, as shown in Figure 2-3. If possible,
cubicles or even separate offices should be part of the layout to reinforce the need-to-know
policy. These labs usually have more library space for software and hardware storage.
State law enforcement or the FBI usually runs most large or regional digital forensics labs. As
shown in Figure 2-4, these labs have a separate evidence room, which is typical in police
investigations, except this room is limited to digital evidence. One or more custodians might
be assigned to manage and control traffic in and out of the evidence room.
As discussed, the evidence room needs to be secure. The lab should have at least two
controlled exits and no windows. Separate offices for supervisors and cubicles for investigators are more practical in this configuration. Remember that forensic workstations are
connected to an isolated LAN, and only a few machines are connected to an outside WAN or
metropolitan area network (MAN).
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
2
76
Chapter 2
Figure 2-3 Mid-size digital forensics lab
ª Cengage Learningâ
Figure 2-4 Regional digital forensics lab
ª Cengage Learningâ
Selecting a Basic Forensic Workstation
The workstation you use as a forensics analysis system depends on your budget and specific
needs. You can find many well-designed forensic workstations that can handle most computing
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Selecting a Basic Forensic Workstation
77
investigation needs. When acquiring a workstation, try to get the most powerful processor and
the most RAM and disk storage available to improve the productivity of digital examinations.
When you start processing a case, you use a workstation for the duration of the examination.
Use less powerful workstations for mundane tasks and multipurpose workstations for
resource-heavy analysis tasks.
Selecting Workstations for a Lab
If you’re managing a lab for a police department in a major city, you probably have the most
diverse needs for computing investigation tools because the communities it serves use a wide
assortment of computing systems. Not all computer users have the latest technology, so a lab
might need legacy systems and software, such as computers running CP/M or Minix, to
match what’s used in the community. For small, local police departments, however, most
work involves Windows PCs and Macintosh systems. A small police department’s digital forensics lab could be limited to one multipurpose forensic workstation with one or two basic
workstations or high-end laptops.
One way to investigate older and unusual computing systems is to keep track of newsgroups
or forums that you can find through an Internet search. These groups can be a valuable
source of support for recovering and analyzing uncommon systems. Entering “computer
forensics” or “digital forensics” as a search keyword produces several links you can follow to
further your knowledge in this profession. You can also coordinate with or subcontract to
larger forensics labs. Like large police departments, a regional digital forensics lab must have
diverse systems to serve its community and often receives work from smaller labs involving
unusual computers or OSs.
Computing systems in a lab should be able to process typical cases in a timely manner. The
time it takes to process a case usually depends on the size and type of industries in the region.
For example, suppose your lab is located in a region with a large manufacturing firm that
employs 50,000 people. Based on crime reports you’ve consulted, 10% of those employees
might be involved in criminal behavior, meaning 5000 employees will commit crimes such as
fraud, embezzlement, and so on. These statistics can help you estimate how much time is
involved in processing these types of cases.
Recent important advances in hardware technology offer more flexibility in digital forensics.
You can now use a laptop PC with FireWire (IEEE 1394B standard), USB 3.0, or SATA hard
disks to create a lightweight, mobile forensic workstation. Improved throughput speeds of
data transfer on laptops also make it easier to create images of suspect drives, especially in
the field.
Selecting Workstations for Private and Corporate Labs
For the private sector, such as a business conducting internal investigations or a commercial
business providing digital forensics services to private parties, equipment resources are generally easy to determine.
Commercial businesses providing forensics analysis for other companies can tailor their services to specific markets. They can specialize in one or two platforms, such as an Intel PC running a Microsoft OS. They can also gather a variety of tools to meet a wider market. The
type of equipment they need depends on their specialty, if any. For general digital forensics
facilities, a multipurpose forensic workstation is sufficient.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
2
78
Chapter 2
Private companies conducting their own internal computing investigations can determine the
type of forensic workstation they need based on the types of computers they use. If a company uses only Windows PCs, internal investigators don’t need a wide variety of specialized
equipment. If a company uses many kinds of computers, the Internal Computing Investigation Department needs systems and equipment that support the same types of computers.
With some digital forensics programs, you can work from a Windows PC and examine both
Windows and Macintosh disk drives.
Stocking Hardware Peripherals
In addition to workstations and software, all labs should have a wide assortment of cables
and spare expansion slot cards. Consider stocking your forensics lab with the following
peripheral devices:
•
40-pin 18-inch and 36-inch IDE cables, both ATA-33 and ATA-100 or faster
•
Ribbon cables for floppy disks
•
Extra USB 3.0 or newer cables and SATA cards and associated cables
•
Extra SCSI cards, preferably ultrawide
•
Graphics cards, both Peripheral Component Interconnect (PCI) and Accelerated
Graphics Port (AGP)
•
Assorted FireWire and USB adapters
•
A variety of hard drives (as many as you can afford and in as wide a variety as possible)
•
At least two 2.5-inch adapters from notebook IDE hard drives to standard IDE/ATA
drives, SATA drives, and so on
•
Computer hand tools, such as Phillips and flathead screwdrivers, a socket wrench, any
vendor-specific tools, and a small flashlight
Maintaining Operating Systems and Software Inventories
Operating systems are an essential part of your lab’s inventory. You should maintain licensed
copies of as many legacy OSs as possible to handle cases involving unusual systems.
Microsoft OSs should include, in addition to the most current OS, Windows 8.0 and 8.1, 7,
Vista, XP, 2000, NT 4.0, NT 3.5, 9x, 3.11, and DOS 6.22. Macintosh OSs should include Mac
OS X, 9.x, and 8 or older. Linux OSs can include Fedora, Ubuntu, Slackware, and Debian.
Although most high-end digital forensics tools can open or display data files created with
commonly used programs, they don’t support all programs. Your software inventory should
include current and older versions of the following programs. If you deal with both Windows
PCs and Macintosh systems, you should have programs for both.
•
Microsoft Office (including current and older versions)
•
Quicken (if you handle a lot of financial investigations)
•
Programming languages, such as Visual Basic and Visual C11 or a programming
development environment, such as Visual Studio
•
Specialized viewers, such as Quick View, ACDSee, ThumbsPlus, and IrfanView
•
LibreOffice, OpenOffice, or Apache OpenOffice
•
Peachtree and QuickBooks accounting applications
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Selecting a Basic Forensic Workstation
79
Using a Disaster Recovery Plan
Besides planning for equipment needs, you need to plan for disasters, such as hard disk
crashes, lightning strikes, power outages, floods, earthquakes, and so forth. A disaster
recovery plan ensures that you can restore your workstations and file servers to their original
condition or a lab-like building if a catastrophic failure occurs.
A disaster recovery plan also specifies how to rebuild a forensic workstation after it has been
severely contaminated by a virus from a drive you’re analyzing. Central to any disaster
recovery plan is a system for backing up investigation computers. Tools such as Norton
Ghost are useful for restoring files directly. As a general precaution, consider backing up your
workstation once a week. You can restore programs from the original disks, USB drives, or
CDs/DVDs, but recovering lost data without up-to-date backups is difficult.
Store your system backups where they are easily accessible. You should have at least one
copy of backups on site and a duplicate copy or a previous copy of backups stored in a safe
off-site facility. Off-site backups are usually rotated on a schedule that varies according to
your needs, such as every day, week, or month.
In addition, record all updates you make to your workstation by using a process called
configuration management. Some companies record updates in a configuration management
database to maintain compliance with lab policy. Every time you add or update software on
your workstation, enter the change in the database or in a simple notebook with handwritten
entries to document the change. A useful tool to run regularly is Belarc Advisor
(www.belarc.com/free download.html), which inventories applications, hardware, and system configurations.
A disaster recovery plan can also address how to restore a workstation you reconfigured for
a specific investigation. For example, if you install a suite of applications, you might not have
enough disk space for normal processing needs, so you could encounter problems during
reconfigurations or even simple upgrades. The disaster recovery plan should outline how to
uninstall software and delete any files the uninstall program hasn’t removed so that you can
restore your system to its original configuration.
For labs using high-end RAID servers (such as Digital Intelligence F.R.E.D.C. or
F.R.E.D.M.), you must consider methods for restoring large data sets. These large-end servers
must have adequate data backup systems in case of a major failure of more than one drive.
When planning a recovery procedure for RAID servers, consider whether the amount of
downtime it takes to restore backup data is acceptable to the lab operation.
Planning for Equipment Upgrades
Risk management involves determining how much risk is acceptable for any process or
operation, such as replacing equipment. Identify the equipment your lab depends on, and create a schedule to replace that equipment. Also, identify equipment that you can replace when
it fails.
Computing components are designed to last 18 to 36 months in normal business operations,
and new versions of OSs and applications that take up more disk space are released
frequently. Therefore, systems periodically need more RAM, disk space, and processing
speed. To keep your lab current with updates in hardware technology, schedule hardware
replacements at least every 18 months and preferably every 12 months.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
2
80
Chapter 2
Building a Business Case for Developing a Forensics Lab
Before you can set up a digital forensics lab, you must enlist the support of managers and
other team members. To do so, you build a business case, a plan you can use to sell your
services to management or clients. In the business case, you justify acquiring newer and better
resources to investigate digital forensics cases.
How you develop a business case depends on the organization you support. If you’re the sole
proprietor, creating a business case is fairly simple. If you need money to buy tools, you can
save your money for the purchase or negotiate with your bank for a loan. For a public entity
such as a police department, business requirements can change drastically because budgets
are planned a year or more in advance. Public agency department managers present their
budget proposals to upper management. If the proposal is approved, upper management
makes money available to acquire resources outlined in the budget. Some public organizations might have other funds available that can be spent immediately for special needs.
Managers can divert these funds for emergency or unforeseen needs.
Like private-sector companies, police departments usually have to
justify expenses to upper management. The important difference is
that police departments don’t always have to show cost recovery for
the additional capabilities new resources and equipment offer.
Keep in mind that a private-sector business, especially a large corporation, is motivated by
the need to make money. A business case should demonstrate how computing investigations
could save money and avoid risks that can damage profits, such as by preventing litigation
involving the company. For example, court decisions have defined viewing pornographic
images in the workplace as creating a hostile environment for other employees, which is
related to employee harassment and computer misuse. An employer is responsible for
preventing and investigating harassment of employees and nonemployees associated with the
workplace. A company is also liable if it doesn’t actively prevent creating a hostile workplace
by providing employee training and investigating allegations of computer misuse. A lawsuit,
regardless of who wins, can cost an employer several hundred thousand dollars. In your
business case, compare the cost of training and conducting computing investigations with the
cost of a lawsuit.
The Internet makes it difficult for employers to provide a safe and secure environment for
employees. In particular, employees can misuse free Web-based e-mail services. These free
services give senders anonymity, making it possible for employees to send inappropriate
e-mails, often in the form of sexual harassment. Because training rarely prevents this type
of behavior, an employer needs to institute an investigation program that involves collecting
network logs, such as proxy server logs, and examining computer disks to locate
traces of message evidence. Chapter 11 discusses e-mail abuse and using e-mail server and
network logs.
Your business case should also show how digital investigations can improve profits, such as
by protecting intellectual property, trade secrets, and future business plans. For example,
when employees leave one company for a competing company, they can reveal vital competitive information to their new employers. Suppose a company called Skateboard International
(SI) has invested research and development funds into a new product that improves the
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Building a Business Case for Developing a Forensics Lab
81
stability of skateboards. Its main competitor is Better Skateboard; this company contacts
Gwen Smith, a disgruntled SI employee, via e-mail and offers her a job. When Gwen leaves
SI, she takes with her the plans for the new product. A few months later, Better Skateboard
introduces a product similar to the skateboard Gwen had been researching at SI. SI recognizes that the new, improved skateboard is similar to the one Gwen had been developing and
consults the noncompete agreement Gwen signed when she was hired. SI thinks the new technology Gwen might have given Better Skateboards belongs to its company. It suspects that
Better Skateboard stole its trade secret and intellectual property.
SI could sue Better Skateboard and demand discovery on internal documents. Because
Gwen and Better Skateboard corresponded via e-mail, a computing investigator needs to
find data related to hiring and research engineering at Better Skateboard. Better Skateboard
can also demand discovery on SI’s research records to determine whether any discrepancies
in product design could disprove the lawsuit. In this example, computing investigations
can allow one company to generate revenue from a new product and prevent the other
company from doing so. Information related to profit and loss makes a persuasive
argument in a business case.
Preparing a Business Case for a Digital Forensics Lab
It’s important to understand the need for planning in the creation and continued maintenance
of a forensics lab. The reason is the constant cost-cutting efforts of upper management.
Because of organizations’ tendencies to look for ways to reduce costs, you must plan ahead
to ensure that money is available for facilities, tools, supplies, and training for your forensics
lab. The following sections describe some key elements for creating a digital forensics business case. It’s a good idea to maintain a business case with annual updates.
Justification Before you can start, you need to justify to the person controlling
the budget the reason a lab is needed. This justification step requires asking the following
questions:
•
What type of computing investigation service is needed for your organization?
•
Who are the potential customers for this service, and how will it be budgeted—as an
internal operation (police department or company security department, for instance) or
an external operation (a for-profit business venture)?
•
How will you advertise your services to customers?
•
What time-management techniques will you use?
•
Where will the initial and sustaining budget for business operations come from?
No matter what type of organization you work for—a public agency or a private business—
operating a digital forensics lab successfully requires constant efforts to market the lab’s services to previous, current, and future customers and clients. By using marketing to attract new
customers or clients, you can justify future budgets for the lab’s operation and staff.
Budget Development The budget needs to include all items described in the following sections. You must be as exact as possible when determining the true cost of these items.
Making a mistake could cause delays and possible loss of the opportunity to start or improve
your lab.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
2
82
Chapter 2
Facility Cost For a new forensics lab, startup costs might take most of the budget.
Depending on how large the lab is, you must determine first how much floor space is needed.
As mentioned, a good rule of thumb is 150 square feet per person. This amount of space
might seem a bit larger than necessary, but consider how much storage space is needed to
preserve evidence and to have enough supplies in stock. Check with your organization’s facility manager on per-square-foot costs for your area or building. Here are some sample questions to answer to get started on calculating a budget:
•
How many digital forensics examiners will you need?
•
How much training will each examiner require per year, and what are the estimated costs?
•
Will you need more than one lab?
•
How many digital forensics examiners will use each lab? Will there be a need to
accommodate other nonexaminers temporarily to inspect recovered evidence?
•
What are the costs to construct a secure lab?
•
Is there a suitable room that can be converted into a lab?
•
Does the designated room have enough electrical power and heating, ventilation, and
air-conditioning (HVAC) systems?
•
Does the designated room have existing phone lines and network cables? If not, how
much will it cost to install these items?
•
Is there an adequate lock on the designated room’s door?
•
What will the furniture costs be?
•
Will you need to install an alarm system?
•
Are there any other facility costs, such as fees for janitorial services and facility maintenance services?
•
If IT support is needed, how many hours of support are estimated?
Hardware Requirements Determining the types of investigations and data that will
be analyzed in your forensics lab dictates what hardware equipment you need. If your organization is using Intel-based PCs with Windows 8.1 or later, for instance, your forensic workstation should be a high-end Intel-based PC, too. For a small police department, determining
the types of computers the public uses is more difficult. The diversity of a community’s computer systems requires a police department to be more versatile in the tools needed to conduct
investigations. To determine computer hardware budget needs, here are some questions to
consider in your planning:
•
What types of investigations and data recovery will be performed in the lab?
•
How many investigations can be expected per month of operation?
•
Will there be any time-sensitive investigations that demand rapid analysis of disk data?
•
What sizes and how many drives will be needed to support a typical investigation?
•
Will you need a high-speed backup system, such as tape backup or DVD burners?
•
What’s the predominant type of computer system you will investigate?
•
What will you use to store digital evidence? How long do you need to store it?
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Building a Business Case for Developing a Forensics Lab
83
Software Requirements In the past few years, many more digital forensics tools
have become available. For the private sector, the cost for these tools ranges from about
$1200 and up. For the public sector, many forensics software vendors offer discounts. However, just as you select hardware for your digital forensics lab to fit specific needs, you must
first determine what type of OSs and applications will be investigated and then make purchases that fit. Keep in mind that the more you spend on a forensics software package, the
more function and flexibility will be available. To determine software budget needs, here are
some questions to consider in your planning:
•
What types of OSs will be examined?
•
For less popular, uncommon, or older OSs (such as Mac OS 9.x, OS/2, and CP/M),
how often will there be a need to investigate them?
•
What are the minimum needs for forensics software tools? For example, how many
copies of each tool will be needed? How often will each tool be used in an average
week?
•
What types of OSs will be needed to conduct routine examinations?
•
Will there be a need for specialized software, such as QuickBooks or Peachtree?
•
Is there a budget to purchase more than one forensics software tool, such as EnCase,
FTK, or ProDiscover?
•
Which disk-editing tool should be selected for general data analysis?
Miscellaneous Budget Needs For this section of the budget, you need to brainstorm on other items, tools, and supplies to consider purchasing for the lab, from general
office supplies to specific needs for daily operations. To determine miscellaneous budget
needs, here are some questions to consider in your planning:
•
Will there be a need for errors and omission insurance for the lab’s operation and
staff?
•
Will you need a budget for office supplies?
Approval and Acquisition The approval and acquisition phase for a digital forensics lab is a management function. It’s your responsibility to create a business case with a
budget to present to upper management for approval. As part of the approval process, you
should include a risk analysis describing how the lab will minimize the risk of litigation,
which is a persuasive argument for supporting the lab. You also need to make an educated
guess of how many investigations are anticipated and how long they will take to complete on
average. Remember that part of the approval process requires using negotiation skills to justify the business case. You might need to revise your case as needed to get approval.
As part of the business case, acquisition planning requires researching different products to
determine which one is the best and most cost effective. You need to contact several vendors’
sales staff and design engineers to learn more about each product and service. Another factor
to investigate is annual maintenance costs. You need to budget for this expense, too, so that
you can get support if you run into problems during an investigation. An additional item to
research from others in the profession is the vendor’s maintenance history. Do other forensics
labs use the same product, and have they had any problems getting support for problems they
encounter?
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
2
84
Chapter 2
Another consideration is vendors’ pricing structures. Vendor pricing isn’t based on the cost
of creating CDs and DVDs and packaging them. Product prices are based on cost for development, testing, documentation support, shipping, and research and development for future
improvements. In addition, vendors are for-profit organizations; they have investors to pay,
too. Keep in mind that for vendors to be around next year to provide products and services
for you, they need to make money.
Implementation After approval and acquisition, you need to plan the implementation
of facilities and tools. As part of your business case, describe how implementation of all
approved items will be processed. A timeline showing expected delivery or installation dates
and expected completion dates must be included. You should also have a coordination plan
for delivery dates and times for materials and tools. Inspection of facility construction, equipment (including furniture and benches), and software tools should be included in the schedule. Make sure you schedule inspection dates, too, to ensure that what you ordered arrived
and is functional.
Acceptance Testing Following the implementation scheduling and inspection, you
need to develop an acceptance test plan for the digital forensics lab to make sure everything
works correctly. When writing the acceptance test plan, consider the following items:
•
Inspect the facility to see whether it meets the security criteria to contain and control
digital evidence.
•
Test all communications, such as phone and network connections, to make sure they
work as expected.
•
Test all hardware to verify that it operates correctly; for example, test a computer to
make sure it boots to Windows.
•
Install and start all software tools; make sure all software can run on the computers
and OSs you have in the lab.
Correction for Acceptance The better you plan for your lab, the less likely you’ll
have problems. However, any lab operation has some problems during startup. Your business case must anticipate problems that can cause delays in lab production. In the business
case, you need to develop contingencies to deal with system or facility failures. For example,
devise workarounds for problems such as the wrong locks being installed on lab doors or
electrical power needing additional filtering.
Production After all essential corrections have been made, your digital forensics lab can
then go into production. At this time, you implement the lab operations procedures that have
been described in this chapter.
For additional information on how to write a business case, see
www.sba.gov/smallbusinessplanner/plan/writeabusinessplan/
index.html.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Key Terms
85
Chapter Summary
䊏
A digital forensics lab is where you conduct investigations, store evidence, and do most
of your work. You use the lab to house your instruments, current and legacy software,
and forensic workstations. In general, you need a variety of digital forensics hardware
and software.
䊏
To continue a career in digital investigations and forensics analysis, you need to
upgrade your skills through training. Several organizations offer training and
certification programs for digital forensics that test you after you have successfully
completed training. Some state and federal government agencies are also considering
establishing certification programs that address minimum skills needed to conduct
digital investigations at different levels.
䊏
Your lab facility must be physically secure so that evidence is not lost, corrupted, or
destroyed.
䊏
Police departments in major cities need a wide assortment of computing systems,
including older, outdated technology. Most digital investigations in small, local
police departments involve Windows PCs and Macintosh systems. As a general rule,
there should be at least one law enforcement digital investigator for every 250,000
people in a geographic region. Commercial services providing forensics analysis for
other businesses can tailor their services to specific markets.
䊏
A forensic workstation needs to have adequate memory, storage, and ports to deal with
the common types of cases that come through your lab.
䊏
Before you can set up a digital forensics lab, you must enlist the support of your managers and other team members by building a business case, a plan you can use to sell
your services to management or clients. In the business case, you justify acquiring
newer and better resources to investigate digital forensics cases.
Key Terms
American Society of Crime Laboratory Directors (ASCLD) A national society that sets the
standards, management, and audit procedures for labs used in crime analysis, including
digital forensics labs used by the police, FBI, and similar organizations.
business case A document that provides justification to upper management or a lender for
purchasing new equipment, software, or other tools when upgrading your facility. In many
instances, a business case shows how upgrades will benefit the company.
Certified Computer Examiner (CCE) A certification from the International Society of Forensic
Computer Examiners.
2
Certified Cyber Forensics Professional (CCFP) A certification from ISC for completing the
education and work experience and passing the exam.
Certified Forensic Computer Examiner (CFCE) A certificate awarded by IACIS at completion
of all portions of the exam.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
2
86
Chapter 2
configuration management The process of keeping track of all upgrades and patches you
apply to your computer’s OS and applications.
digital forensics lab A lab dedicated to digital investigations; typically, it has a variety of
computers, OSs, and forensics software.
High Tech Crime Network (HTCN) A national organization that provides certification for
computer crime investigators and digital forensics technicians.
risk management The process of determining how much risk is acceptable for any process or
operation, such as replacing equipment.
secure facility A facility that can be locked and allows limited access to the room’s contents.
TEMPEST A term referring to facilities that have been hardened so that electrical signals from
digital devices, computer networks, and telephone systems can’t be monitored or accessed
easily by someone outside the facility.
Uniform Crime Report Information collected at the federal, state, and local levels to
determine the types and frequencies of crimes committed.
Review Questions
1. An employer can be held liable for e-mail harassment. True or False?
2. Building a business case can involve which of the following?
a. Procedures for gathering evidence
b.
Testing software
c.
Protecting trade secrets
d.
All of the above
3. The ASCLD mandates the procedures established for a digital forensics lab. True or
False?
4. The manager of a digital forensics lab is responsible for which of the following? (Choose
all that apply.)
a. Making necessary changes in lab procedures and software
b.
Ensuring that staff members have enough training to do the job
c.
Knowing the lab objectives
d.
None of the above
5. To determine the types of operating systems needed in your lab, list two sources of
information you could use.
6. What items should your business plan include?
7. List two popular certification systems for digital forensics.
8. Why is physical security so critical for digital forensics labs?
9. If a visitor to your digital forensics lab is a personal friend, it’s not necessary to have him
or her sign the visitor’s log. True or False?
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
87
10. What three items should you research before enlisting in a certification program?
11. Large digital forensics labs should have at least
12. Typically, a(n)
exits.
lab has a separate storage area or room for evidence.
13. Digital forensics facilities always have windows. True or False?
14. Evidence storage containers should have several master keys. True or False?
15. A forensic workstation should always have a direct broadband connection to the
Internet. True or False?
16. Which organization provides good information on safe storage containers?
17. Which organization has guidelines on how to operate a digital forensics lab?
18. What term refers to labs constructed to shield EMR emissions?
Hands-On Projects
Hands-On Project 2-1
You have just been hired to perform digital investigations and forensics analysis for a company. You find that no policies, processes, or procedures are currently in place. Do an Internet search to find information, and then create a
policy and processes document to provide the structure necessary for your lab
environment. Be sure to cite your online sources.
Hands-On Project 2-2
As mentioned, new forensics certifications are offered constantly. Research
certifications online and find one not discussed in this chapter. Write a short
paper stating what organization offers the certification, who endorses the certification, how long the organization has been in business, and so forth.
Hands-On Project 2-3
Physical security of a lab must always be maintained. In your classroom lab,
get permission to make observations at different times of the day when classes
are and aren’t in session. Record how many people go in and out during a
period. Do you know all the people or can you identify them? Are they all
students or faculty? Who monitors the lab when classes aren’t in session? Are
the rooms locked? How often are things stolen from the labs? Write one to
two pages about your observations. If it were a digital forensics lab, what
changes would you have to make?
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
2
88
Chapter 2
Hands-On Project 2-4
Write a disaster recovery plan of not more than three pages for a fictitious
company’s digital forensics lab. Include backup schedules, note the programs
and OS installed on each machine, and list other information you would have
to recover after a disaster. You should also note where the original disks and
backups are located.
Hands-On Project 2-5
A law firm has hired you to assist with digital evidence cases involving divorces.
The main evidence consists of e-mail, spreadsheets, and documents. Before hiring you, the firm used an outside group to conduct investigations. You have to
decide what equipment and software to purchase. What would you do to build
a business plan that would be approved?
Case Projects
Case Project 2-1
Your manager informs you that she needs to prepare for next year’s budget
and wants you to prepare a list of hardware and software for two new workstations and one laptop, all Windows computers. Conduct Internet research,
and create a spreadsheet listing hardware and software for each computer with
estimated costs. For the computers, include specifications such as processor
speeds, RAM, internal disk storage, and type of monitor. For software, include
an OS, an office suite, and two digital forensics tools.
Case Project 2-2
A new version of Windows has been released. What do you need to do to be
ready in 6 to 10 months when you encounter cases involving the new OS?
Include research, user groups, and others you need to contact. Write a onepage paper on the procedures you should use.
Case Project 2-3
Research your state, province, or neighboring states and provinces to determine whether digital forensics examiners require licenses. Write a one-page
summary of the licensing requirements in the region you selected. If your
region doesn’t have any licensing requirements, research one of the following
states: Michigan, Texas, or Georgia.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
chapter
3
Data Acquisition
After reading this chapter and completing
the exercises, you will be able to:
• List digital evidence storage formats
• Explain ways to determine the best acquisition method
• Describe contingency planning for data acquisitions
• Explain how to use acquisition tools
• Describe how to validate data acquisitions
• Describe RAID acquisition methods
• Explain how to use remote network acquisition tools
• List other forensics tools available for data acquisitions
89
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
90
Chapter 3
Data acquisition is the process of copying data. For digital forensics, it’s the task of
collecting digital evidence from electronic media. There are two types of data acquisition: static
acquisitions and live acquisitions. In this chapter, you learn how to perform static acquisitions
from magnetic disk media and flash drives. In Chapter 12, you learn how to forensically
acquire digital evidence from solid-state devices, typically found in smartphones and tablets.
Because of the use of whole disk encryption, data acquisitions are shifting toward live acquisitions with newer operating systems (OSs). In addition to encryption concerns, collecting any
data that’s active in a suspect’s computer RAM is becoming more important to digital investigations. Techniques for acquiring live disk and RAM data are covered in Chapter 10. The
processes and data integrity requirements for static and live acquisitions are similar, in that
static acquisitions capture data that’s not accessed by other processes that can change. With
live acquisitions, file metadata, such as date and time values, changes when read by an acquisition tool. With static acquisitions, if you have preserved the original media, making a second static acquisition should produce the same results. The data on the original disk isn’t
altered, no matter how many times an acquisition is done. Making a second live acquisition
while a computer is running collects new data because of dynamic changes in the OS.
Your goal when acquiring data for a static acquisition is to preserve the digital evidence.
Many times, you have only one chance to create a reliable copy of disk evidence with a data
acquisition tool. Although these tools are generally dependable, you should still take steps to
make sure you acquire an image that can be verified. In addition, failures can and do occur,
so you should learn how to use several acquisition tools and methods; you work with a few
different tools in this chapter. Other data acquisition tools that work in Windows, MS-DOS
6.22, and Linux are described briefly in the last section, but the list of vendors and methods
is by no means conclusive. You should always search for newer and better tools to ensure the
integrity of your forensics acquisitions.
For additional information on older acquisition methods and tools, see
Appendix D. You can perform most digital evidence acquisitions for
your investigations with a combination of the tools discussed in this
chapter.
Understanding Storage Formats for Digital Evidence
Chapter 1 introduced the process of acquiring data from a USB drive and storing it in a data
file. The acquisition tool you used, ProDiscover Basic, performed a bit-by-bit (or sector-bysector) copy of the USB drive and wrote it to an image file, which was an exact duplicate of
the source device (the USB drive).
For additional information on digital evidence handling and documenting, see ISO/IEC 27037: 2012, www.iso.org/iso/catalogue
detail?csnumber¼44381. Downloading ISO documents requires
paying a fee, so you might check with a college or public library about
getting a copy.
The data a forensics acquisition tool collects is stored as an image file, typically in an opensource or proprietary format. Each vendor has unique features, so several different
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding Storage Formats for Digital Evidence
91
proprietary formats are available. Depending on the proprietary format, many forensics analysis tools can read other vendors’ formatted acquisitions. Many forensics acquisition tools
create a disk-to-image file in an older open-source format, known as raw, as well as their
own proprietary formats. The new open-source format, Advanced Forensic Format (AFF), is
gaining recognition from some forensics examiners.
Each data acquisition format has unique features along with advantages and disadvantages.
The following sections summarize each format to help you choose which one to use.
Raw Format
In the past, there was only one practical way of copying data for the purpose of evidence
preservation and examination. Examiners performed a bit-by-bit copy from one disk to
another disk the same size or larger. As a practical way to preserve digital evidence, vendors
(and some OS utilities, such as the Linux/UNIX dd command) made it possible to write bitstream data to files. This copy technique creates simple sequential flat files of a suspect drive
or data set. The output of these flat files is referred to as a raw format. This format has
unique advantages and disadvantages to consider when selecting an acquisition format.
The advantages of the raw format are fast data transfers and the capability to ignore minor
data read errors on the source drive. In addition, most forensics tools can read the raw format, making it a universal acquisition format for most tools. One disadvantage of the raw
format is that it requires as much storage space as the original disk or data set. Another disadvantage is that some raw format tools, typically freeware versions, might not collect marginal (bad) sectors on the source drive, meaning they have a low threshold of retry reads on
weak media spots on a drive. Many commercial tools have a much higher threshold of retry
reads to ensure that all data is collected.
Several commercial acquisition tools can produce raw format acquisitions and typically perform a validation check by using Cyclic Redundancy Check (CRC32), Message Digest 5
(MD5), and Secure Hash Algorithm (SHA-1 or later) hashing functions. These validation
checks, however, usually create a separate file containing the hash value.
Proprietary Formats
Most commercial forensics tools have their own formats for collecting digital evidence. Proprietary formats typically offer several features that complement the vendor’s analysis tool,
such as the following:
•
The option to compress or not compress image files of a suspect drive, thus saving
space on the target drive
•
The capability to split an image into smaller segmented files for archiving purposes,
such as to CDs or DVDs, with data integrity checks integrated into each segment
•
The capability to integrate metadata into the image file, such as date and time of the acquisition, hash value (for self-authentication) of the original disk or medium, investigator or examiner name, and comments or case details
Forensics examiners have several ways of referring to copying evidence
data to files: bit-stream copy, bit-stream image, image, mirror, and
sector copy, to name a few. For the purposes of this book, “image” is
generally used to refer to all forensics acquisitions saved to a data file.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
92
Chapter 3
One major disadvantage of proprietary format acquisitions is the inability to share an image
between different vendors’ computer forensics analysis tools. For example, the ILookIX imaging tool IXimager produces three proprietary formats—IDIF, IRBF, and IEIF—that can be
read only by ILookIX (see www.perlustro.com for additional information on ILookIX). If
necessary, IXimager can copy IDIF, IRBF, and IEIF formats to a raw format image file that
can be read by other tools.
Another problem with proprietary and raw formats is a file size limitation for each segmented
volume. Typically, proprietary format tools produce a segmented file of 650 MB. The file size
can be adjusted up or down, with a maximum file size per segment of no more than 2 GB.
Most proprietary format tools go up to only 2 GB because many examiners use a target drive
formatted as FAT, which has a file size limit of 2 GB.
Of all the proprietary formats for image acquisitions, the Expert Witness format is currently
the unofficial standard. This format, the default for Guidance Software EnCase, produces
both compressed and uncompressed image files. These files (or volumes) write an extension
starting with .e01 and incrementing it for each additional segmented image volume.
Several forensics analysis tools can generate generic versions of the Expert Witness format and
analyze it, including X-Ways Forensics, AccessData Forensic Toolkit (FTK), and SMART. For
more information on the Expert Witness format, see http://asrdata.com/E01-format.html.
Advanced Forensic Format
Dr. Simson L. Garfinkel developed an open-source acquisition format called Advanced Forensic Format (AFF). This format has the following design goals:
•
Capable of producing compressed or uncompressed image files
•
No size restriction for disk-to-image files
•
Space in the image file or segmented files for metadata
•
Simple design with extensibility
•
Open source for multiple computing platforms and OSs
•
Internal consistency checks for self-authentication
File extensions include .afd for segmented image files and .afm for AFF metadata. Because
AFF is open source, digital forensics vendors have no implementation restrictions on this format. For more information on AFF, see www.afflib.sourceforge.net and www.basistech.com/
wp-content/uploads/datasheets/Digital-Forensics-Toolsets-EN.pdf.
For more information on forensics acquisition file formats, see
www.sleuthkit.org/informer, issues #19 and #23.
Determining the Best Acquisition Method
As mentioned, there are two types of acquisitions: static acquisitions and live acquisitions.
Typically, a static acquisition is done on a computer seized during a police raid, for example.
If the computer has an encrypted drive, a live acquisition is done if the password or
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Determining the Best Acquisition Method
93
passphrase is available—meaning the computer is powered on and has been logged on to by
the suspect. Static acquisitions are always the preferred way to collect digital evidence. However, they do have limitations in some situations, such as an encrypted drive that’s readable
only when the computer is powered on or a computer that’s accessible only over a network.
Some solutions can help decrypt a drive that has been encrypted with whole disk encryption,
such as Elcomsoft Forensic Disk Decryptor (www.elcomsoft.com/efdd.html).
In Chapter 10, you learn how to perform live acquisitions, including
data collection of digital media and dynamic/volatile memory (RAM)
on a computing system.
For both types of acquisitions, data can be collected with four methods: creating a disk-toimage file, creating a disk-to-disk copy, creating a logical disk-to-disk or disk-to-data file, or
creating a sparse copy of a folder or file. Determining the best acquisition method depends on
the circumstances of the investigation.
See ISO/IEC 27037: 2012 (section 5.4.4 Acquisition and section 6.5
Use reasonable care) for additional discussions on when to perform
sparse acquisitions.
Creating a disk-to-image file is the most common method and offers the most flexibility for
your investigation. With this method, you can make one or many copies of a suspect drive.
These copies are bit-for-bit replications of the original drive. In addition, you can use other
forensics tools, such as ProDiscover, EnCase, FTK, SMART, Sleuth Kit, X-Ways Forensics,
and ILookIX, to read the most common types of disk-to-image files you create. These programs read the disk-to-image file as though it were the original disk. MS-DOS tools can only
read data from a drive. To use MS-DOS tools, you have to duplicate the original drive to perform the analysis. GUI programs save time and disk resources because they can read and
interpret directly from the disk-to-image file of a copied drive.
Sometimes you can’t make a disk-to-image file because of hardware or software errors or
incompatibilities. This problem is more common when you have to acquire older drives. For
these drives, you might have to create a disk-to-disk copy of the suspect drive. Several imaging
tools can copy data exactly from an older disk to a newer disk. These programs can adjust the
target disk’s geometry (its cylinder, head, and track configuration) so that the copied data
matches the original suspect drive. These imaging tools include EnCase and X-Ways Forensics.
See the vendors’ manuals for instructions on using these tools for disk-to-disk copying.
For more information on current and older drives, see www.t13.org.
Collecting evidence from a large drive can take several hours. If your time is limited, consider
using a logical acquisition or sparse acquisition data copy method. A logical acquisition captures only specific files of interest to the case or specific types of files. A sparse acquisition is
similar but also collects fragments of unallocated (deleted) data; use this method only when
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
94
Chapter 3
you don’t need to examine the entire drive. An example of a logical acquisition is an e-mail
investigation that requires collecting only Outlook .pst or .ost files. Another example is
collecting only specific records from a large RAID server. If you have to recover data from a
RAID or storage area network (SAN) server with several exabytes (EB) or more of data storage, the logical method might be the only way you can acquire the evidence. In e-discovery
for the purpose of litigation, a logical acquisition is becoming the preferred method, especially with large data storage systems.
To determine which acquisition method to use for an investigation, consider the size of the
source (suspect) disk, whether you can retain the source disk as evidence or must return it to the
owner, how much time you have to perform the acquisition, and where the evidence is located.
If the source disk is very large, such as 4 terabytes (TB) or more, make sure you have a target
disk that can store a disk-to-image file of the large disk. If you don’t have a target disk of comparable size, review alternatives for reducing the size of data to create a verifiable copy of the
suspect drive. Older Microsoft disk compression tools, such as DoubleSpace or DriveSpace,
eliminate only slack disk space between files. Other compression methods use an algorithm to
reduce file size. Popular archiving tools, such as PKZip, WinZip, and WinRAR, use an algorithm referred to as “lossless compression.” Compression algorithms for graphics files use
what’s called “lossy compression,” which can change data. For example, lossy compression is
used with .jpeg files to reduce file size and doesn’t affect image quality when the file is
restored and viewed. Because lossy compression alters original data, however, it isn’t used for
forensics acquisitions. Both compression methods are discussed in more detail in Chapter 8.
Most imaging tools have an option to use lossless compression to save disk space, which
means the target drive doesn’t have to be as large as the suspect drive. For example, if you
have a SATA 3 TB suspect drive, you might be able to use lossless compression to create the
disk-to-image file on a 2 TB target drive. Image files can be reduced by as much as 50% of
the original. If the suspect drive already contains compressed data, such as several large zip
files, the imaging tool can’t compress the data any further, however.
An easy way to test lossless compression is to perform an MD5 or SHA-1 hash on a file
before and after it’s compressed. If the compression is done correctly, both versions have the
same hash value. If the hashes don’t match, that means something corrupted the compressed
file, such as a hardware or software error. As an added precaution, perform two separate
hashes with different algorithms, such as MD5 and SHA-1. This step isn’t mandatory; however, it’s a good way to establish that nothing has changed during data processing.
If you can’t retain the original evidence drive and must return it to the owner, as in a discovery
demand for a civil litigation case, check with the requester (your lawyer or supervisor, for
example), and ask whether a logical acquisition is acceptable. If not, you have to refer the matter back to the requester. When performing an acquisition under these conditions, make sure
you have a good copy because most discovery demands give you only one chance to capture
data. In addition, make sure you have a reliable forensics tool that you know how to use.
Contingency Planning for Image Acquisitions
Because you’re working with digital evidence, you must take precautions to protect it from
loss. You should also make contingency plans in case software or hardware doesn’t work or
you encounter a failure during an acquisition. The most common and time-consuming
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Acquisition Tools
95
technique for preserving evidence is creating a duplicate of your disk-to-image file. Many digital investigators don’t make duplicates of their evidence because they don’t have enough time
or resources to make a second image. However, if the first copy doesn’t work correctly, having a duplicate is worth the effort and resources. Be sure you take steps to minimize the risk
of failure in your investigation.
As a standard practice, make at least two images of the digital evidence you collect. If you
have more than one imaging tool, such as ProDiscover, FTK, and X-Ways Forensics, make
the first copy with one tool and the second copy with the other tool. If you have only one
tool, consider making two images of the drive with the same tool, especially for critical investigations. With tools such as EnCase, X-Ways Forensics, FTK Imager, and ProDiscover, you
can make one copy with no compression and compress the other copy. Remember that Murphy’s Law applies to digital forensics, too: If anything can go wrong, it will.
Some acquisition tools don’t copy data in the host protected area (HPA) of a disk drive.
Check the vendor’s documentation to verify that its tool can copy a drive’s HPA. For these
situations, consider using a hardware acquisition tool that can access the drive at the BIOS
level, such as ProDiscover with a write-blocker, ImageMASSter Solo, or X-Ways Replica.
These tools can read a disk’s HPA.
Microsoft has added whole disk encryption with BitLocker to its newer operating systems,
such as Windows 7 and 8, which makes performing static acquisitions more difficult. (Several
other third-party whole disk encryption tools are available, and you should be familiar with
as many as possible.) As part of contingency planning, you must be prepared to deal with
encrypted drives. A static acquisition on most whole disk–encrypted drives currently involves
decrypting the drives, which requires the user’s cooperation in providing the decryption key.
Most whole disk encryption tools at least have a manual process for decrypting data, which
is converting the encrypted disk to an unencrypted disk. This process can take several hours,
depending on the disk size. One good thing about encryption is that data isn’t altered, in that
free and slack space aren’t changed. The biggest concern with whole disk encryption is getting the decryption key—that is, the password or code used to access encrypted data. If you
can recover the whole disk key with tools such as Elcomsoft Forensic Disk Decryptor, mentioned previously, you need to learn how to use it to decrypt the drive. In criminal investigations, this might be impossible because if a disk contains evidence supporting the crime, a
suspect has a strong motivation not to supply the decryption key.
Researchers at Princeton University have produced a technique to
recover passwords and passphrases from RAM; for more information,
visit http://citp.princeton.edu/pub/coldboot.pdf
Using Acquisition Tools
Many forensics software vendors have developed acquisition tools that run in Windows.
These tools make acquiring evidence from a suspect drive more convenient, especially when
you use them with hot-swappable devices, such as USB-3, FireWire 1394A and 1394B, or
SATA, to connect disks to your workstation.
Windows acquisition tools have some drawbacks, however. Because Windows can easily
contaminate an evidence drive when it mounts it, you must protect it with a well-tested
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
96
Chapter 3
write-blocking hardware device. The automatic mounting process updates boot files by
changing metadata, such as the most recent access time. (Chapter 6 discusses write-blocking
devices in more detail.) Another drawback is that most Windows tools can’t acquire data
from a disk’s host protected area. In addition, some countries haven’t yet accepted the use of
write-blocking devices for data acquisitions. Check with your legal counsel for evidence
standards in your community or country.
Mini-WinFE Boot CDs and USB Drives
Accessing a computer’s disk drive directly might not be practical for a forensics acquisition. For
example, a laptop’s design could make removing the disk drive to mount it on a write-blocker
difficult, or you might not have the right connector for a drive. In these situations, a forensic
boot CD/DVD or USB drive gives you a way to acquire data from a suspect computer and
write-protect the disk drive. These forensic boot discs or drives can be Windows or Linux.
One forensically sound Windows boot utility is Mini-WinFE. It enables you to build a
Windows forensic boot CD/DVD or USB drive with a modification in its Windows Registry
file so that connected drives are mounted as read-only. Before booting a suspect’s computer
with Mini-WinFE, you need to connect your target drive, such as a USB drive. After MiniWinFE is booted, you can list all connected drives and alter your target USB drive to readwrite mode so that you can run an acquisition program, such as FTK Imager Lite or X-Ways
Forensics.
To create your own Mini-WinFE boot CD or USB drive, review the documentation and
download the software from the following Web sites:
•
For an overview of WinFE, see http://winfe.wordpress.com. For the latest information
and instructions, review the Downloads and Using WinFE menus.
•
For download instructions on Mini-WinFE, see http://winfe.wordpress.com/
downloads-2/mini-winfe.
•
Another download site for Mini-WinFE is http://reboot.pro/files/file/375-mini-winfe.
•
For complete instructions on Mini-WinFE, see http://mistype.reboot.pro/mini-winfe.
docs/readme.html.
In addition, you need a Windows installation DVD (version 8 or later) and FTK Imager Lite
or X-Ways Forensics installed on your workstation. Follow the instructions in the preceding
Web sites to create the Mini-WinFE ISO file and then burn it to CD or transfer it to a USB
drive. If you want to use a USB drive, you need a tool to transfer an ISO image to a USB
drive. A freeware tool called ISO to USB is available at www.isotousb.com.
For a history of the evolution of WinFE and the people involved in its
development, see Appendix B.
Acquiring Data with a Linux Boot CD
The Linux OS has many features that are applicable to digital forensics, especially data
acquisitions. One unique feature is that Linux can access a drive that isn’t mounted. Physical
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Acquisition Tools
97
access for the purpose of reading data can be done on a connected media device, such as
a disk drive, a USB drive, or other storage devices. In Windows OSs and newer Linux
kernels, when you connect a drive via USB, FireWire, external SATA, or even internal
PATA or SATA controllers, both OSs automatically mount and access the drive. On
Windows drives, an acquisition workstation can access and alter data in the Recycle Bin;
on Linux drives, the workstation most likely alters metadata, such as mount point configurations for an Ext3 or Ext4 drive. If you need to acquire a USB drive that doesn’t have a
write-lock switch, use one of the forensic Linux Live CDs (discussed in the next section) to
access the device.
Use caution when working with newer Linux distributions with KDE or
Gnome GUIs. Many newer distributions mount most media devices
automatically. If you’re using a nonforensic Linux distribution, you
should test it before using it on actual evidence to see how it handles
attached storage devices. If in doubt, always use a physical writeblocker for an acquisition from Linux.
Using Linux Live CD Distributions Several Linux distributions, such as Ubuntu,
openSUSE, Arch Linux, Fedora, and Slackware, provide ISO images that can be burned to a
CD or DVD. They’re called “Linux Live CDs.” Most of these Linux distributions are for
Linux OS recovery, not for digital forensics acquisition and analysis. For a list of the most
current Linux Live CDs, see www.frozentech.com or http://livecdlist.com.
A few Linux ISO images are designed specifically for digital forensics, however. These images
contain additional utilities that aren’t typically installed in normal Linux distributions.
They’re also configured not to mount, or to mount as read-only, any connected storage
media, such as USB drives. This feature protects the media’s integrity for the purpose of
acquiring and analyzing data. To access media, you have to give specific instructions to the
Live CD boot session through a GUI utility or a shell command prompt. Mounting drives
from a shell gives you more control over them. See the man page for the mount command
(by typing man mount at the shell prompt) to learn what options are available for your Linux
distribution.
The man command displays pages from the online help manual for
information on Linux commands and their options.
Linux can read data from a physical device without having to mount it. As a usual practice,
don’t mount a suspect media device as a precaution against any writes to it. Later in this section, you learn how to make a forensics acquisition in Linux without mounting the device.
The following are some well-designed Linux Live CDs for digital forensics:
•
Penguin Sleuth (www.linux-forensics.com)
•
F.I.R.E (http://fire.dmzs.com)
•
CAINE (www.caine-live.net)
•
Deft (www.deftlinux.net)
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
98
Chapter 3
•
Kali Linux (www.kali.org), previously known as BackTrack (www.backtrack-linux.
org/wiki/index.php/Forensics Boot)
•
Knoppix (www.knopper.net/knoppix/index-en.html)
•
SANS Investigate Forensic Toolkit (SIFT; http://computer-forensics.sans.org/
community/downloads)
You can download these ISO images to any computer, including a Windows system, and then
burn them to CD/DVD with burner software, such as Roxio or Nero. Creating a bootable
image from an ISO file is different from copying data or music files to a CD or DVD. If you
aren’t familiar with how to do it, see the Help menu in your burner software for instructions
on creating a bootable CD or DVD. For example, Roxio Creator Classic and Nero Express
have a Bootable CD or DVD option. An alternative is using a USB drive instead of a CD or
DVD. For this option, you need a tool such as ISO to USB, mentioned previously (or another
tool for transferring an ISO image to a USB drive).
After creating a Linux Live CD, test it on your workstation. Remember to check your workstation’s BIOS to see whether it boots first from the CD or DVD on the system. To test the
Live CD, simply place it in the CD or DVD drive and reboot your system. If successful, Linux
loads into your computer’s memory, and a common GUI for Linux is displayed. If you have
problems with the video display on your workstation, try another computer with a different
video card. No one Live CD distribution has all video drivers. Linux Live CDs load the OS
into a computer’s RAM, so performance can be affected when you’re using GUI tools. The
following sections explain how to use Linux to make forensically sound data acquisitions.
Preparing a Target Drive for Acquisition in Linux The Linux OS has many
tools you can use to modify non-Linux file systems. Current Linux distributions can create
Microsoft FAT and NTFS partition tables. Linux kernel version 2.6.17.7 and earlier can format and read only the FAT file system, although an NTFS driver, NTFS-3G, is available that
allows Linux to mount and write data only to NTFS partitions. You can download this
driver from http://sourceforge.net/projects/ntfs-3g, where you can also find information about
NTFS and instructions for installing the driver. For information on Mac OS X file systems
and acquisitions, see Chapter 7.
In this section, you learn how to partition and format a Microsoft FAT drive from Linux so
that you don’t have to switch OSs or computers to prepare a FAT target disk. If you have a
previously used target drive, you can use the following procedure to format it as a FAT32
drive. After you make the acquisition, you can then transfer the FAT disk to a Windows system to use a Windows analysis tool.
When preparing a drive to be used on a Linux system for forensics
acquisition or analysis, do it in a separate boot session with no suspect
drive attached.
Linux/UNIX commands are case sensitive, so make sure you type
commands exactly as shown in this section’s steps.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Acquisition Tools
99
Assuming you have a functioning Linux computer or one running with a Linux Live CD,
perform the following steps from a shell prompt:
Depending on which version and distribution of Linux you use, your
screen prompts might be slightly different from those mentioned in
this section.
1. First, boot Linux on your computer.
2. Connect the USB, FireWire, or SATA external drive to the Linux computer and power
it on.
3. If a shell window isn’t already open, start one.
4. At the shell prompt, type su and press Enter to log in as the superuser (root). Then
type the root password and press Enter.
If you’re using one of the Live CDs listed previously, these distributions
are typically already in superuser (root) mode, so there’s no need to
use the su command. Other Linux Live CDs might have no password
set and simply require pressing Enter.
5. To list the current disk devices connected to the computer, type fdisk -l (lowercase
L) and press Enter. You should see output similar to the following:
Linux lists all IDE (also known as PATA) drives as hda, hdb, and so on.
All SCSI, SATA, FireWire, and USB-connected drives are listed as sda,
sdb, and so forth.
Disk /dev/hda: 40.0 GB, 40007761920 bytes
255 heads, 63 sectors/track, 4864 cylinders
Units ¼ cylinders of 16065 * 512 ¼ 8225280 bytes
Device Boot
/dev/hda1 *
/dev/hda2
Start
1
14
End
13
4864
Blocks
104391
389656571
Id
83
8e
System
Linux
Linux LVM
Disk /dev/sda: 6448 MB, 6448619520 bytes
199 heads, 62 sectors/track, 1020 cylinders
Units ¼ cylinders of 12338 * 512 ¼ 6317056 bytes
Disk /dev/sda doesn't contain a valid partition table
In the preceding output, the /dev/sda device has no partition listed.
These steps show how to create a Microsoft FAT partition on this disk.
If there’s a partition on this drive, it can be deleted with the Linux
fdisk utility. For additional information on fdisk, refer to the man
page.
6. Type fdisk /dev/sda and press Enter to partition the disk drive as a FAT file system. You should see output similar to the following:
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
100
Chapter 3
Welcome to fdisk (util-linux 2.21.2).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.
Command (m for help): m
7. Display fdisk menu options by typing m and pressing Enter. You should see output
similar to the following:
Command action
a toggle a bootable flag
b edit bsd disklabel
c toggle the dos compatibility flag
d delete a partition
l list known partition types
m print this menu
n add a new partition
o create a new empty DOS partition table
p print the partition table
q quit without saving changes
s create a new empty Sun disk label
t change a partition's system id
u change display/entry units
v verify the partition table
w write table to disk and exit
x extra functionality (experts only)
8. Determine whether there are any partitions on /dev/sda by typing p and pressing
Enter. You should see output similar to the following:
Disk /dev/sda: 6448 MB, 6448619520 bytes
199 heads, 62 sectors/track, 1020 cylinders
Units ¼ cylinders of 12338 * 512 ¼ 6317056 bytes
Device Boot
/dev/sda1
Start
1
End
1020
Blocks
6292349 b
Id
W95
System
FAT32
In this example, the disk has no previously configured partitions. If it
did, there would be data under each column heading describing each
partition’s configuration.
9. Next, you create a new primary partition on /dev/sda. To use the defaults and
select the entire drive, type n and press Enter. To create a primary partition table, type
p and press Enter, and then type 1 (the numeral) to select the first partition and press
Enter. At the remaining prompts, press Enter. Your output should be similar to the
following:
Command action
e extended
p primary partition (1-4)
p
Partition number (1-4): 1
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Acquisition Tools
101
First cylinder (1-1020, default 1):
Using default value 1
Last cylinder or 1size or 1sizeM or 1sizeK (1-1020, default 1020):
Using default value 1020
In Linux, the first logical partition created after the primary and
extended partitions is numbered 5; any additional logical partitions
are numbered 6, 7, and so on. For example, the C partition is typically
/dev/hda1, and the D partition is /dev/hda2.
10. List the newly defined partitions by typing p and pressing Enter, which produces the
following output:
Disk /dev/sda: 6448 MB, 6448619520 bytes
199 heads, 62 sectors/track, 1020 cylinders
Units ¼ cylinders of 12338 * 512 ¼ 6317056 bytes
Device Boot
/dev/sda1
Start
1
End
1020
Blocks
6292349
Id
83
System
Linux
11. To list the menu again so that you can select the change partition ID, type m and press
Enter. You should see output similar to the following:
Command action
a toggle a bootable flag
b edit bsd disk label
c toggle the dos compatibility flag
d delete a partition
l list known partition types
m print this menu
n add a new partition
o create a new empty DOS partition table
p print the partition table
q quit without saving changes
s create a new empty Sun disk label
t change a partition's system id
u change display/entry units
v verify the partition table
w write table to disk and exit
x extra functionality (experts only)
12. To change the newly created partition to the Windows 95 FAT32 file system, first
type t and press Enter, which produces the following output:
Selected partition 1
Hex code (type L to list codes):
13. List available file systems and their code values by typing l (lowercase L) and pressing
Enter. You should see output similar to what’s shown in Figure 3-1.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
102
Chapter 3
Figure 3-1 Listing code values for available file systems
Source: Adapted from Linux commands
14. Change the newly created partition to the Windows 95 FAT32 file system by typing c
and pressing Enter. Your output should look similar to the following:
Changed system type of partition 1 to c (W95 FAT32 (LBA))
15. To display partitions of the newly changed drive, type p and press Enter, which
produces the following output:
Disk /dev/sda: 6448 MB, 6448619520 bytes
199 heads, 62 sectors/track, 1020 cylinders
Units ¼ cylinders of 12338 * 512 ¼ 6317056 bytes
Device Boot
/dev/sda1
Start
1
End
1020
Blocks
6292349
Id
c
System
W95 FAT32 (LBA)
16. Save (write) the newly created partition to the /dev/sda drive by typing w and pressing Enter. Your output should look similar to the following:
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Acquisition Tools
103
The partition table has been altered!
Calling ioctl() to re-read partition table.
WARNING: If you have created or modified any DOS 6.x partitions,
please see the fdisk manual page for additional information.
Syncing disks.
Fdisk exits back to the shell prompt after updating the partition
table on the /dev/sda drive.
17. Show the known drives connected to your computer by typing fdisk -l and pressing Enter, which produces the following output:
Disk /dev/hda: 40.0 GB, 40007761920 bytes
255 heads, 63 sectors/track, 4864 cylinders
Units ¼ cylinders of 16065 * 512 ¼ 8225280 bytes
Device Boot
/dev/hda1 *
/dev/hda2
Start
1
14
End
13
4864
Blocks
104391
389656571
Id
83
8e
System
Linux
Linux LVM
Disk /dev/sda: 6448 MB, 6448619520 bytes
199 heads, 62 sectors/track, 1020 cylinders
Units ¼ cylinders of 12338 * 512 ¼ 6317056 bytes
Device Boot
/dev/sda1
Start
1
End
1020
Blocks
6292349
Id
b
System
W95 FAT32
18. To format a FAT file system from Linux, type mkfs.msdos -vF32 /dev/sda1 and
press Enter, which produces the following output:
If your Linux distribution is missing the mkfs.msdos command, you
need to download and install your distribution’s dosfstools
package. To find these files, search for mkfs.msdos Fedora or
dostools Debian, for example.
mkfs.msdos 2.8 (28 Feb 2001)
Selecting 8 sectors per cluster
/dev/sde1 has 33 heads and 61 sectors per track,
logical sector size is 512,
using 0xf8 media descriptor, with 2047966 sectors;
file system has 2 32-bit FATs and 8 sectors per cluster.
FAT size is 1997 sectors, and provides 255492 clusters.
Volume ID is 420781ea, no volume label.
Newer Linux distributions automatically sync the newly created partition and format the drive. The sync feature eliminates the need to
reboot the computer.
19. Close the shell window for this session by typing exit and pressing Enter.
This drive can now be mounted and used to receive an image of a suspect drive. Later in this
section, you learn how to mount and write to this Microsoft FAT target drive.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
104
Chapter 3
Acquiring Data with dd in Linux A unique feature of a forensics Linux Live CD
is that it can mount and read most drives. To perform a data acquisition on a suspect computer, all you need are the following:
•
A forensics Linux Live CD
•
A USB, FireWire, or SATA external drive with cables
•
Knowledge of how to alter the suspect computer’s BIOS to boot from the Linux Live CD
•
Knowledge of which shell commands to use for the data acquisition
If you want to learn more about Linux and shell commands, review a
Linux tutorial, such as Nix Tutor at www.nixtutor.com/linux/all-thebest-linux-cheat-sheets.
The dd command, available on all UNIX and Linux distributions, means “data dump.” This
command, which has many functions and switches, can be used to read and write data from
a media device and a data file. The dd command isn’t bound by a logical file system’s
data structures, meaning the drive doesn’t have to be mounted for dd to access it. For example, if you list a physical device name, the dd command copies the entire device—all data
files, slack space, and free space (unallocated data) on the device. The dd command creates a
raw format file that most forensics analysis tools can read, which makes it useful for data
acquisitions.
Use extreme caution with the dd command. Make sure you know
which drives are the suspect drive and target drive. Although you
might not have mounted the suspect drive, if you reverse the input
field (if¼) of the suspect and target drives with the output field
(of¼), data is written to the wrong drive, thus destroying the original
evidence drive.
As powerful as this command is, it does have some shortcomings. One major problem is that
it requires more advanced skills than the average computer user might have. Also, because it
doesn’t compress data, the target drive needs to be equal to or larger than the suspect drive.
It’s possible to divide the output to other drives if a large enough target drive isn’t available,
but this process can be cumbersome and prone to mistakes when you’re trying to keep track
of which data blocks to copy to which target drive.
The dd command combined with the split command segments output into separate volumes. Use the split command with the -b switch to adjust the size of segmented volumes
the dd command creates. As a standard practice for archiving purposes, create segmented
volumes that fit on a CD or DVD. For additional information on dd and split, see their
man pages.
Follow these steps to make an image of an NTFS disk on a FAT32 disk by using the dd
command:
1. Assuming that your workstation is the suspect computer and is booted from a Linux
Live CD, connect the USB, FireWire, or SATA external drive containing the FAT32
target drive, and turn the external drive on.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Acquisition Tools
105
2. If you’re not at a shell prompt, start a shell window, switch to superuser (su) mode,
type the root password, and press Enter.
3. At the shell prompt, list all drives connected to the computer by typing fdisk -l and
pressing Enter, which produces the following output:
Disk /dev/hda: 40.0 GB, 40007761920 bytes
255 heads, 63 sectors/track, 4864 cylinders
Units ¼ cylinders of 16065 * 512 ¼ 8225280 bytes
Device Boot
/dev/hda1 *
/dev/hda2
Start
1
14
End
13
4864
3
Blocks
104391
389656571
Id
83
8e
System
Linux
Linux LVM
Id
b
5
c
System
W95 FAT32
Extended
W95 FAT32 (LBA)
Disk /dev/sda: 163.9 GB, 163928605184 bytes
255 heads, 63 sectors/track, 19929 cylinders
Units ¼ cylinders of 16065 * 512 ¼ 8225280 bytes
Device Boot
/dev/sda1
/dev/sda2
/dev/sda5
Start
1
12001
12001
End
12000
19929
19929
Blocks
963899681
636896921
63689661
Disk /dev/sdb: 6448 MB, 6448619520 bytes
199 heads, 62 sectors/track, 1020 cylinders
Units ¼ cylinders of 12338 * 512 ¼ 6317056 bytes
Device Boot
/dev/sdb1
Start
1
End
1020
Blocks
6292349
Id
7
System
HPFS/NTFS
4. To create a mount point for the USB, FireWire, or SATA external drive and partition,
make a directory in /mnt by typing mkdir /mnt/sda5 and pressing Enter.
5. To mount the target drive partition, type mount -t vfat /dev/sda5 /mnt/sda5
and press Enter.
6. To change your default directory to the target drive, type cd /mnt/sda5 and press
Enter.
7. List the contents of the target drive’s root level by typing ls -al and pressing Enter.
Your output should be similar to the following:
total 40
drwxr-xr-x 2 root root 32768 Dec 31 1969 .
drwxr-xr-x 5 root root 4096 Feb 6 17:22 ..
8. To make a target directory to receive image saves of the suspect drive, type mkdir
case01 and press Enter.
9. To change to the newly created target directory, type cd case01 and press Enter.
Don’t close the shell window.
Next, you perform a raw format image of the entire suspect drive to the target directory. To
do this, you use the split command with the dd command. The split command creates a
two-letter extension for each segmented volume. The -d switch creates numeric rather than
letter extensions. As a general rule, if you plan to use a Windows forensics tool to examine a
dd image file created with this switch, the segmented volumes shouldn’t exceed 2 GB each
because of FAT32 file size limits. This 2 GB limit allows you to copy only up to 198 GB of a
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
106
Chapter 3
suspect’s disk. If you need to use the dd command, it’s better to use the split command’s
default of incremented letter extensions and make smaller segments. To adjust the segmented
volume size, change the value for the -b switch from the 650 MB used in the following example to 2000 MB.
1. First, type dd if¼/dev/sdb j split -b 650m - image sdb. and press Enter. You
should see output similar to the following:
1259496010 records in
1259496010 records out
When using the split command, type a period at the end of the line
as shown, with no space between it and the filename. Otherwise, the
extension is appended to the filename with no “.” delimiter.
2. Now list the raw images that have been created from the dd and split commands by
typing ls -l and pressing Enter. You should see output similar to the following:
total 6297504
-rwxr-xr-x
1
-rwxr-xr-x
1
-rwxr-xr-x
1
-rwxr-xr-x
1
-rwxr-xr-x
1
-rwxr-xr-x
1
-rwxr-xr-x
1
-rwxr-xr-x
1
-rwxr-xr-x
1
-rwxr-xr-x
1
root root 681574400 Feb
root root 681574400 Feb
root root 681574400 Feb
root root 681574400 Feb
root root 681574400 Feb
root root 681574400 Feb
root root 681574400 Feb
root root 681574400 Feb
root root 681574400 Feb
root root 314449920 Feb
6 17:26 image_sdb.aa
6 17:28 image_sdb.ab
6 17:29 image_sdb.ac
6 17:30 image_sdb.ad
6 17:32 image_sdb.ae
6 17:33 image_sdb.af
6 17:34 image_sdb.ag
6 17:36 image_sdb.ah
6 17:37 image_sdb.ai
6 17:37 image_sdb.aj
3. To complete this acquisition, dismount the target drive by typing umount /dev/sda5
and pressing Enter.
Depending on the Windows forensics analysis tool you’re using, renaming each segmented
volume’s extension with incremented numbers instead of letters might be necessary. For
example, rename image_sdb.aa as image_sdb.01, and so on. Several Windows forensics
tools can read only disk-to-image segmented files that have numeric extensions. Most Linux
forensics tools can read segments with numeric or lettered extensions.
Acquiring a specific partition on a drive works the same way as acquiring the entire drive.
Instead of typing /dev/sdb as you would for the entire drive, add the partition number to
the device name, such as /dev/sdb1. For drives with additional partitions, use the number
that would be listed in the fdisk -l output. For example, to copy only the partition of the
previous NTFS drive, you use the following dd command:
dd if¼/dev/sdb1 j split -b 650m - image_sdb1
Remember to use caution with the dd command in your forensics data acquisitions.
Acquiring Data with dcfldd in Linux The dd command is intended as a data
management tool; it’s not designed for forensics acquisitions. Because of these shortcomings,
Nicholas Harbour of the Defense Computer Forensics Laboratory (DCFL) developed a tool
that can be added to most UNIX/Linux OSs. This tool, the dcfldd command, works similarly
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Acquisition Tools
107
to the dd command but has many features designed for forensics acquisitions. The following
are important functions dcfldd offers that aren’t possible with dd:
•
Specify hexadecimal patterns or text for clearing disk space.
•
Log errors to an output file for analysis and review.
•
Use the hashing options MD5, SHA-1, SHA-256, SHA-384, and SHA-512 with logging and the option of specifying the number of bytes to hash, such as specific blocks
or sectors.
•
Refer to a status display indicating the acquisition’s progress in bytes.
•
Split data acquisitions into segmented volumes with numeric extensions (unlike dd’s
limit of 99).
•
Verify the acquired data with the original disk or media data.
When using dcfldd, you should follow the same precautions as with dd. The dcfldd command can also write to the wrong device, if you aren’t careful.
The following examples show how to use the dcfldd command to acquire data from a 64
MB USB drive, although you can use the command on a larger media device. All commands
need to be run from a privileged root shell session. To acquire an entire media device in one
image file, you type the following command at the shell prompt:
dcfldd if¼/dev/sda of¼usbimg.dat
If the suspect media or disk needs to be segmented, use the dcfldd command with the split
command, placing split before the output file field (of¼), as shown here:
dcfldd if¼/dev/sda split¼2M of¼usbimg hash¼md5
This command creates segmented volumes of 2 MB each. To create segmented volumes that
fit on a CD of 650 MB, change the split¼2M to split¼650M. This command also displays the MD5 value of the acquired data.
For additional information on the dcfldd command, see http://dcfldd.
sourceforge.net. Information on how to download and install dcfldd
is available for many UNIX, Linux, and Macintosh OSs. You can also
use the man page to find more information on dcfldd features and
switches.
Capturing an Image with ProDiscover Basic
In Chapter 2, you learned how to acquire an image of a USB drive. ProDiscover automates
many acquisition functions, unlike current Linux tools. Because USB drives are typically
small, a single image file can be acquired with no need to segment it. In this section, you learn
how to make an image of a larger drive and apply the Split function in ProDiscover Basic to
create segmented files of 650 MB each that can be archived to CDs.
Before acquiring data directly from a suspect drive with ProDiscover
Basic, always use a hardware write-blocker device.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
108
Chapter 3
The following activity assumes you have removed the suspect drive and connected it to a USB
or FireWire write-blocker device connected to your forensic workstation. The acquisition is
written to a work folder on your C drive, assuming it has enough free space for the acquired
data. Follow these steps to perform the first task of connecting the suspect’s drive to your
workstation:
1. Document the chain of evidence for the drive you plan to acquire.
2. Remove the drive from the suspect’s computer.
3. For IDE drives, configure the suspect drive’s jumpers as needed. (Note: This step
doesn’t apply to SATA or USB drives.)
4. Connect the suspect drive to the USB or FireWire write-blocker device.
5. Create a storage folder on the target drive. For this activity, you use your work folder
(C:nWorknChap03nChapter), but in real life, you’d use a folder name such as
C:nEvidence.
The work folder shown in screenshots might differ from the work
folder you’ve created for this chapter’s activities.
Using ProDiscover’s Proprietary Acquisition Format Follow these steps
to perform the second task, starting ProDiscover Basic and configuring settings for the
acquisition:
1. Start ProDiscover Basic. (Remember to click the Run as administrator option if
you’re using Windows Vista or later.) If the Startup dialog box opens, click Cancel.
2. In the ProDiscover Basic window, click Action, Capture Image from the menu.
3. In the Capture Image dialog box, click the Source Drive list arrow, and then click
PhysicalDrive1 xxxx GB.
With Windows 7 and later, the source (or suspect) drive might differ
from your computer when it’s displayed in the Capture Image dialog
box. In this example, it’s listed as PhysicalDrive 1 7.500 GB. If you have
additional drives connected to your workstation, the PhysicalDrive
number varies, such as PhysicalDrive2. Always verify your current
drives and their numbers before connecting your source drive so that
you know which new drive is your target drive after it’s connected. To
verify all drives on a Windows computer, start the Computer Management utility in the Computer window, and click Disk Management.
4. Click the >> button next to the Destination text box, and click Choose Local Path. In
the Save As dialog box, navigate to the work folder you set up. In the File name text
box, type InChp031, and then click Save.
5. Click the Split button. In the Split Image dialog box shown in Figure 3-2, type 650 for
a small drive or 2000 for a larger drive in the “Split into equal sized image of” text
box, click Split, and then click OK.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Acquisition Tools
109
3
Figure 3-2 The Split Image dialog box
Courtesy of Technology Pathways, LLC
If your target drive is FAT32, you’re limited to 2 GB (2000 MB) split file
sizes. For larger files, you need an NTFS-formatted drive.
6. In the Capture Image dialog box, click the Image Format list arrow, and click
ProDiscover Format (recommended), if it’s not already selected.
7. In the Technician Name text box, type your name, and in the Image Number text
box, type InChp03 (see Figure 3-3). If you like, in the Description text box, type any
comments related to the case.
8. If you needed to save space on your target drive, you would click the Yes option
button in the Compression section. For this and other activities in this book, click No.
9. If additional security is needed for the acquired image, click Password. In the
Password dialog box, enter a new password once, type it again to confirm it,
and then click OK.
10. When you’re finished entering information in the Capture Image dialog box, click OK
to begin the acquisition. ProDiscover then creates a segmented image file in your work
folder. During this acquisition, ProDiscover displays a status bar in the lower-right
corner to show the progress for each volume segment it’s creating.
11. When the acquisition is done, ProDiscover displays a message box instructing you
to examine a log file for errors. Click OK to finish the acquisition, and then exit
ProDiscover Basic.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
110
Chapter 3
Figure 3-3 The Capture Image dialog box
Courtesy of Technology Pathways, LLC
ProDiscover then creates image files (segmented volumes) with an .eve extension, a log file
(.log extension) listing any errors that occurred during the acquisition, and a special inventory file (.pds extension) that tells ProDiscover how many segmented volumes were created.
All these files have the prefix you specified in the Capture Image dialog box. ProDiscover uses
the .pds file to load all segmented volumes in the correct order for analysis.
For this activity, ProDiscover produced four files. Two are segments of the suspect drive’s
split image, one is the log file, and one is the .pds file. A larger drive would have more than
two segmented volumes. The first segmented volume (volume one) has the extension .eve,
and all other segmented volumes have the suffix -Split1, -Split2, -Split3, and so on before the
.eve extension. If the compression option was selected, ProDiscover uses a .cmp rather than
an .eve extension on all segmented volumes.
Using ProDiscover’s Raw Acquisition Format For versatility, ProDiscover
can produce raw format acquisitions that many other forensics tools can read. To perform a raw
format acquisition, follow the same steps as for the proprietary format in the Capture Image
dialog box, but select the “UNIX style dd” format in the Image Format list box. When you select
this option, the input fields at the bottom of the Capture Image dialog box are grayed out. To
segment the image acquisition, click the Split button as you would for the proprietary format.
To initiate the raw acquisition, click OK, and then click Proceed in the warning box, which
simply advises you that the raw acquisition saves only the image data and hash value. When
the raw acquisition is finished, click OK in the message box.
The raw format creates a log file (.pds extension) and segmented volume files, just like the
proprietary format acquisition. Another file with the .md5 extension is created, which contains the MD5 hash for the acquired drive. In the proprietary format, the hash value, the time
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Acquisition Tools
111
zone where the acquisition occurred, the password if it was specified, the investigator’s name,
and any comments entered in the Description text box are stored in the .eve file.
Capturing an Image with AccessData FTK Imager Lite
FTK Imager is a data acquisition tool that’s included with a licensed copy of AccessData
Forensic Toolkit. Like most Windows data acquisition tools, it requires using a USB dongle for
licensing. FTK Imager Lite is free and requires no dongle license and can be downloaded at
www.accessdata.com/support/product-downloads. FTK Imager is available for both Windows
and Macintosh. Find FTK Imager in the Current Releases section, click to expand the available
tools, and select FTK Imager Lite. After downloading this tool, install it on your workstation.
FTK Imager is designed for viewing evidence disks and disk-to-image files created from other
proprietary formats. It can read AccessData .ad1, Expert Witness (EnCase) .e01, SMART
.s01, Advanced Forensic Format, and raw format files. In addition to disk media, FTK
Imager can read CD and DVD file systems. This program shows a view of a disk partition or
an image file as though it’s a mounted partition, with additional panes showing the contents
of the selected file (see Figure 3-4).
Figure 3-4 The FTK Imager main window
ª 2014 AccessData Group, Inc. All Rights Reserved
FTK Imager can make disk-to-image copies of evidence drives and enables you to acquire an
evidence drive from a logical partition level or a physical drive level. You can also define the
size of each disk-to-image file volume, allowing you to segment the image into one or many
split volumes. For example, you can specify 650 MB volume segments if you plan to store
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
112
Chapter 3
volumes on 650 MB CD-Rs or 2.0 GB volume segments so that you can record volumes
on DVD-/1Rs. An additional feature of FTK Imager is that it can image RAM on a live
computer. The evidence drive you’re acquiring data from must have a hardware writeblocking device or run from a Live CD, such Mini-WinFE.
FTK Imager can’t acquire a drive’s host protected area, however. In other words, if the
drive’s specifications indicate it has 11,000,000 sectors and the BIOS display indicates
9,000,000, a host protected area of 2,000,000 sectors might be assigned to the drive. If you
suspect an evidence drive has a host protected area, you must use an advanced acquisition
tool, such as ProDiscover, OS Forensics, or X-Ways Replica, to include this area when copying data. With older MS-DOS tools, you might have to define the exact sector count to make
sure you include more than what the BIOS shows as the number of known sectors on a drive.
Review vendors’ manuals to determine how to account for a drive’s host protected area.
In the following activity, you use FTK Imager Lite to make an image file. Use a write-blocking
device to protect the suspect drive, and then follow these steps:
1. Boot your forensic workstation to Windows, using an installed write-blocker.
2. Connect the evidence drive to a write-blocking device or USB device.
3. Connect the target drive to a USB external drive, if you’re using a write-blocker.
4. Start FTK Imager Lite. If prompted by the User Account Control message box, click Yes.
5. In the FTK Imager main window, click File, Create Disk Image from the menu.
6. In the Select Source dialog box, click the Physical Drive option button, if necessary,
and then click Next.
7. In the Select Drive dialog box, click the Source Drive Selection list arrow
(see Figure 3-5), click the suspect drive, and then click Finish.
Figure 3-5 The Select Drive dialog box
ª 2014 AccessData Group, Inc. All Rights Reserved
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Acquisition Tools
113
8. In the Create Image dialog box, click to select the Verify images after they are created
check box, if necessary, and then click Add. In the Select Image Type dialog box that
opens (see Figure 3-6), click the Raw (dd) option button, if necessary, and then click
Next.
3
Figure 3-6 The Select Image Type dialog box
ª 2014 AccessData Group, Inc. All Rights Reserved
9. In the Evidence Item Information dialog box, complete the case information, as
shown in Figure 3-7, and then click Next.
Figure 3-7 The Evidence Item Information dialog box
ª 2014 AccessData Group, Inc. All Rights Reserved
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
114
Chapter 3
10. In the Select Image Destination dialog box (see Figure 3-8), click Browse, navigate to
the location for the image file (your work folder), and click to clear the Use AD
Encryption check box, if necessary.
Figure 3-8 Selecting where to save the image file
ª 2014 AccessData Group, Inc. All Rights Reserved
You can adjust the segmented volume size in this dialog box, but for
this activity, leave the default value of 1500 MB.
11. In the Image Filename (Excluding Extension) text box, type InChp03-ftk, and then
click Finish.
12. Next, in the Create Image dialog box, click Start to initiate the acquisition.
13. When FTK Imager finishes the acquisition, review the information in the Drive/Image
Verify Results dialog box, and then click Close. Click Close again in the Creating
Image dialog box (see Figure 3-9).
14. Exit FTK Imager Lite by clicking File, Exit from the menu.
For additional information, see the Help menu in FTK Imager to learn
more about its many features.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Validating Data Acquisitions
115
3
Figure 3-9 A completed image save
ª 2014 AccessData Group, Inc. All Rights Reserved
Validating Data Acquisitions
Probably the most critical aspect of computer forensics is validating digital evidence. The
weakest point of any digital investigation is the integrity of the data you collect, so validation
is essential. In this section, you learn how to use several tools to validate data acquisitions.
Validating digital evidence requires using a hashing algorithm utility, which is designed to
create a binary or hexadecimal number that represents the uniqueness of a data set, such as a
file or disk drive. This unique number is referred to as a “digital fingerprint.” With a few
exceptions, making any alteration in one of the files—even changing one letter from uppercase to lowercase—produces a completely different hash value.
These exceptions, known as “collisions,” have been found to occur in a small number of files
with MD5, and SHA-1 might also be subject to collisions. For forensic examinations of data
files on a disk drive, however, collisions are of little concern. If two files with different content
have the same MD5 hash value, a comparison of each byte of a file can be done to see the differences. Currently, several tools can do a byte-by-byte comparison of files. Programs such as
X-Ways Forensics, X-Ways WinHex, and IDM Computing Solution’s UltraCompare can analyze and compare data files. For more information on MD5 collisions, see www.x-ways.net/
md5collision.html or www.mscs.dal.ca/selinger/md5collision/. Chapter 4 discusses methods
of using MD5 and SHA-1.
For imaging an evidence drive, many tools offer validation techniques ranging from CRC-32,
MD5, and SHA-1 to SHA-512. These hashing algorithm utilities are available as stand-alone
programs or are integrated into many acquisition tools. The following sections discuss how
to perform validation with some currently available acquisition programs.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
116
Chapter 3
Linux Validation Methods
Linux is rich in commands and functions. The two Linux shell commands shown earlier in
this chapter, dd and dcfldd, have several options that can be combined with other commands to validate data. The dcfldd command has additional options that validate data collected from an acquisition. Validating acquired data with the dd command requires using
other shell commands.
Current distributions of Linux include two hashing algorithm utilities: md5sum and
sha1sum. Both utilities can compute hashes of a single file, multiple files, individual or multiple disk partitions, or an entire disk drive.
Validating dd Acquired Data As shown earlier, the following command produces
segmented volumes of the /dev/sdb drive, with each segmented volume named image_sdb
and an incrementing extension of .aa, .ab, .ac, and so on:
dd if¼/dev/sdb j split -b 650m - image_sdb
To validate all segmented volumes of a suspect drive with the md5sum utility, you use the
Linux shell commands in the following steps. For the saved images, remember to change to
the directory where the data was saved, or list the exact path for the saved images. To use
sha1sum instead of md5sum, just replace all md5sum references in commands with
sha1sum. The drive should still be connected to your acquisition workstation.
1. If necessary, start Linux, open a shell window, and navigate to the directory where
image files are saved. To calculate the hash value of the original drive, type md5sum
/dev/sdb [ md5 sdb.txt and press Enter.
The redirect ([) option saves the computed MD5 hash value in the
md5_sdb.txt file. This file should be saved with image files as validation of the evidence.
2. To compute the MD5 hash value for the segmented volumes and append the output to
the md5_sdb.txt file, type cat image sdb.* j md5sum [[ md5 sdb.txt and
press Enter.
By using the cat (concatenate) command with an asterisk (*) as the
extension value, all segmented volumes are read sequentially as one
big contiguous file, as though they were the original drive or partition.
The pipe (j) function outputs the cat command read data to the
input of the md5sum command. The >> option adds the md5sum
hash results to the end of the md5_sdb.txt file’s content.
3. Examine the md5_sdb.txt file to see whether both hashes match by typing cat
md5 sdb.txt and pressing Enter. If the data acquisition is successful, the two hash
numbers should be identical. If not, the acquisition didn’t work correctly. You should
see output similar to the following:
34963884a4bc5810b130018b00da9de1
34963884a4bc5810b130018b00da9de1
/dev/sdb
4. Close the Linux shell window by typing exit and pressing Enter.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Validating Data Acquisitions
117
With the dd command, the md5sum or sha1sum utilities should be run on all suspect disks
and volumes or segmented volumes.
Validating dcfldd Acquired Data Because dcfldd is designed for forensics data
acquisition, it has validation options integrated: hash and hashlog. You use the hash
option to designate a hashing algorithm of md5, sha1, sha256, sha384, or sha512. The
hashlog option outputs hash results to a text file that can be stored with image files.
To create an MD5 hash output file during a dcfldd acquisition, you enter the following command (in one line) at the shell prompt:
dcfldd if¼/dev/sda split¼2M of¼usbimg hash¼md5
hashlog¼usbhash.log
To see the results of files generated with the split command, you enter the list directory
(ls) command at the shell prompt. You should see the following output:
usbhash.logusbimg.004 usbimg.010 usbimg.016 usbimg.022 usbimg.028
usbseghash.logusbimg.005 usbimg.011 usbimg.017 usbimg.023 usbimg.029
usbimg.000 usbimg.006 usbimg.012 usbimg.018 usbimg.024 usbimg.030
usbimg.001 usbimg.007 usbimg.013 usbimg.019 usbimg.025
usbimg.002 usbimg.008 usbimg.014 usbimg.020 usbimg.026
usbimg.003 usbimg.009 usbimg.015 usbimg.021 usbimg.027
Note that the first segmented volume has the extension .000 rather than .001. Some
Windows forensics tools might not be able to read segmented file extensions starting with
.000. They are typically looking for .001. If your forensics tool requires starting with an
.001 extension, the files need to be renamed incrementally. So segmented file .000 should
be renamed .001, .001 should be renamed .002, and so on.
Another useful dcfldd option is vf (verify file), which compares the image file to the original
medium, such as a partition or drive. The vf option applies only to a nonsegmented image file.
To validate segmented files from dcfldd, use the md5sum or sha1sum command described
previously. To use the vf option, you enter the following command at the shell prompt:
dcfldd if¼/dev/sda vf¼sda_hash.img
For additional information on dcfldd, see the man page.
Windows Validation Methods
Unlike Linux, Windows has no built-in hashing algorithm tools for digital forensics. However, many Windows third-party programs do have a variety of built-in tools. These thirdparty programs range from hexadecimal editors, such as X-Ways WinHex or Breakpoint
Software Hex Workshop, to forensics programs, such as ProDiscover, EnCase, and FTK. In
Chapter 9, you learn how to hash specific data by using a hexadecimal editor to locate and
verify groups of data that have no file association or are sections within a file.
Commercial forensics programs also have built-in validation features. Each program has its
own validation technique used with acquisition data in its proprietary format. For example,
ProDiscover’s .eve files contain metadata in the acquisition file or segmented files, including
the hash value for the suspect drive or partition. Image data loaded into ProDiscover is
hashed and then compared with the hash value in the stored metadata. If the hashes don’t
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
118
Chapter 3
match, ProDiscover notifies you that the acquisition is corrupt and can’t be considered reliable evidence. This function is called Auto Verify Image Checksum.
In ProDiscover and many other forensics tools, however, raw format image files don’t contain metadata. As mentioned, a separate manual validation is recommended for all raw
acquisitions at the time of analysis. The previously generated validation file for raw format
acquisitions is essential to the integrity of digital evidence. The saved validation file can be
used later to check whether the acquisition file is still good.
In FTK Imager, when you select the Expert Witness (.e01) or the SMART (.s01) format,
additional options for validation are displayed. This validation report also lists the MD5 and
SHA-1 hash values. The MD5 hash value is added to the proprietary format image or segmented files. When this image is loaded into FTK, SMART, or X-Ways Forensics (which can
read only .e01 and raw files), the MD5 hash is read and compared with the image to verify
whether the acquisition is correct.
You can find other open-source hashing tools online; just search for “windows open source
hash” to find the latest available Windows hashing tools. For example, a recent search
turned up SourceForge md5deep at http://md5deep.sourceforge.net and Software Informer at
http://softwaresolution.informer.com/Hash-Tool.
Performing RAID Data Acquisitions
Acquisitions of RAID drives can be challenging and frustrating for digital forensics examiners
because of how RAID systems are designed, configured, and sized. Size is the biggest concern because many RAID systems are now pushing into terabytes of data. The following sections review common RAID configurations and discuss ways to acquire data on these large
storage devices.
Understanding RAID
Redundant array of independent (formerly “inexpensive”) disks (RAID) is a computer configuration involving two or more physical disks. Originally, RAID was developed as a dataredundancy measure to minimize data loss caused by a disk failure. As technology improved,
RAID also provided increased storage capabilities.
Several levels of RAID can be implemented through software or special hardware controllers.
For Windows XP, 2000, and NT servers and workstations, RAID 0 or 1 is available. For a
high-end data-processing environment, RAID 5 is common and is often based in special
RAID towers. These high-end RAID systems usually have integrated controllers that connect
to high-end servers or mainframes. These systems provide redundancy and high-speed data
access and can make many small disks appear as one very large drive.
Other variations of RAID besides 0, 1, and 5 are specific to their
vendor or application.
RAID 0 provides rapid access and increased data storage (see Figure 3-10). In RAID 0, two
or more disk drives become one large volume, so the computer views the disks as a single
disk. The tracks of data on this mode of storage cross over to each disk. The logical
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Performing RAID Data Acquisitions
119
3
Figure 3-10 RAID 0: Striping
ª Cengage Learningâ
addressing scheme makes it seem as though each track of data is continuous throughout all
disks. If you have two disks configured as RAID 0, track one starts on the first physical disk
and continues to the second physical disk. When viewed from a booted OS, such as Windows
XP or later, the two disks appear as one large disk. The advantage of RAID 0 is increased speed
and data storage capability spread over two or more disks that can be one large disk partition.
Its biggest disadvantage is lack of redundancy; if a disk fails, data isn’t continuously available.
RAID 1, shown in Figure 3-11, is made up of two disks for each volume and is designed for
data recovery in the event of a disk failure. The contents of the two disks in RAID 1 are identical. When data is written to a volume, the OS writes the data twice—once to each disk at
the same time. If one drive fails, the OS switches to the other disk.
Figure 3-11 RAID 1: Mirroring
ª Cengage Learningâ
RAID 1 ensures that data isn’t lost and helps prevent computer downtime. The main disadvantage of RAID 1 is that it takes two disks for each volume, which doubles the cost of disk storage.
Like RAID 1, RAID 2 (see Figure 3-12) provides rapid access and increased storage by configuring two or more disks as one large volume. The difference with RAID 2 is that data is
written to disks on a bit level. An error-correcting code (ECC) is used to verify whether the
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
120
Chapter 3
Figure 3-12 RAID 2: Striping (bit level)
ª Cengage Learningâ
write is successful. RAID 2, therefore, has better data integrity checking than RAID 0.
Because of the bit-level writes and the ECC, however, RAID 2 is slower than RAID 0.
RAID 3 uses data striping and dedicated parity and requires at least three disks. Similar to
RAID 0, RAID 3 stripes tracks across all disks that make up one volume. RAID 3 also implements dedicated parity of data to ensure recovery if data is corrupted. Dedicated parity is
stored on one disk in the RAID 3 array. Like RAID 3, RAID 4 uses data striping and dedicated parity (block writing), except data is written in blocks rather than bytes.
RAID 5 (see Figure 3-13) is similar to RAID 0 and RAID 3 in that it uses distributed data
and distributed parity and stripes data tracks across all disks in the RAID array. Unlike RAID
3, however, RAID 5 places parity data on each disk. If a disk in a RAID array has a data failure, the parity on other disks rebuilds the corrupt data automatically when the failed drive is
replaced.
In RAID 6, distributed data and distributed parity (double parity) function the same way as
RAID 5, except each disk in the RAID array has redundant parity. The advantage of RAID 6
over RAID 5 is that it recovers any two disks that fail because of the additional parity stored
on each disk.
RAID 10, or mirrored striping, also known as RAID 110, is a combination of RAID 1 and
RAID 0. It provides fast access and redundancy of data storage. RAID 15, or mirrored striping with parity, also known as RAID 115, is a combination of RAID 1 and RAID 5. It offers
the most robust data recovery capability and speed of access of all RAID configurations and
is also more costly.
Figure 3-13 RAID 5: Block-level striping with distributed parity
ª Cengage Learningâ
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Performing RAID Data Acquisitions
121
Acquiring RAID Disks
There’s no simple method for getting an image of a RAID server’s disks. You need to address
the following concerns:
•
How much data storage is needed to acquire all data for a forensics image?
•
What type of RAID is used? Is it Windows RAID 0 or 1 or an integrated hardwarefirmware vendor’s RAID 5, 10, or 15? Is it another unknown configuration or OS
(Linux, UNIX, mainframe)?
•
Do you have an acquisition tool capable of copying the data correctly?
•
Can the tool read a forensic copy of a RAID image?
•
Can the tool read split data saves of each RAID disk, and then combine all images of
each disk into one RAID virtual drive for analysis?
With the larger disks now available, copying small RAID systems to one large disk is possible, similar to the way non-RAID suspect drives are copied. For example, a small server running eight 36 GB SCSI drives in a RAID 0 tower requires about a 300 GB SATA or IDE
(PATA) drive. Less data storage is needed if a proprietary format acquisition is used with
compression applied. All forensics analysis tools can analyze an image because they see the
acquired data as one large drive, not eight separate drives.
Several forensics vendors have added RAID recovery features. These vendors typically specialize in one or two types of RAID formats. The following are some vendors offering RAID
acquisition functions:
•
Technology Pathways ProDiscover
•
Guidance Software EnCase
•
X-Ways Forensics
•
AccessData FTK
•
Runtime Software
•
R-Tools Technologies
You should know which vendor supports which RAID format and keep up to date on the latest improvements in these products.
ProDiscover can acquire RAID disks at the physical level. After all disks have been acquired,
a ProDiscover Group file (.pdg extension) is created, which includes instructions for how
ProDiscover should load each physical disk’s image data. It also lists the paths to each physical disk’s image data if the RAID acquisition takes several storage drives.
Being able to separate each physical disk into smaller save sets eliminates the need to have
one large drive for storing acquired data. Acquiring RAID data requires only similar-size
drives that match each disk in the RAID array. For example, with a RAID 0 array of three
250 GB disks, all you need are three target drives of the same size. If each acquisition is compressed, you might be able to get by with slightly smaller target drives.
With ProDiscover, all you need are three 250 GB target drives to collect the image’s segmented files for each disk. This feature eliminates the need for a 750 GB drive to collect the
combined data from all three 250 GB drives. EnCase and X-Ways Forensics also have similar
features for RAID 0 and 5 acquisitions.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
122
Chapter 3
Other tools, such as Runtime Software (www.runtime.org) and R-Tools Technologies
(www.r-tt.com), are designed as data recovery tools. Although not intended as forensics acquisition tools, they have unique features that can aid in recovering corrupted RAID data
and can perform raw format acquisitions and repair broken RAID 0 and 5 systems. The
Runtime RAID Reconstructor tool copies the original RAID to a raw format file, which must
then be restored on another RAID-configured system where repairs can be performed. It also
scans and corrects errors on the newly copied RAID. R-Tools R-Studio creates a virtual volume of the RAID image file. All repairs are made on the virtual volume, which can then be
restored to the original RAID.
Occasionally, a RAID system is too large for a static acquisition. Under ideal circumstances,
your goal is to collect a complete image of evidence drives. Because RAID systems can have
dozens or more terabytes of data storage, copying all data isn’t always practical. For these
occasions, retrieving only the data relevant to the investigation with the sparse or logical acquisition method is the only practical solution. When dealing with very large RAID servers,
consult with the forensics vendor to determine how to best capture RAID data. Another possible solution is renting portable RAIDBanks for your acquisition.
Using Remote Network Acquisition Tools
Recent improvements in forensics tools include the capability to acquire disk data or data
fragments (sparse or logical) remotely. With this feature, you can connect to a suspect computer remotely via a network connection and copy data from it. Remote acquisition tools
vary in configurations and capabilities. Some require manual intervention on remote suspect
computers to initiate the data copy. Others can acquire data surreptitiously through an
encrypted link by pushing a remote access program to the suspect’s computer. From an investigation perspective, being able to connect to a suspect’s computer remotely to perform an acquisition has tremendous appeal. It saves time because you don’t have to go to a suspect’s
computer, and it minimizes the chances of a suspect discovering that an investigation is taking place. Most remote acquisitions have to be done as live acquisitions, not static acquisitions. When performing remote acquisitions, advanced privileges are required to push agent
applications to the remote system.
There are some drawbacks to consider, such as antivirus, antispyware, and firewall tools.
Most of these security programs can be configured to ignore remote access programs. However, if suspects have administrator rights on their computers, they could easily install their
own security tools that trigger an alarm to notify them of remote access intrusions.
The following section describes how to perform remote acquisitions in ProDiscover. Chapter
10 covers other resources for data copying and explains how to perform a live forensics
acquisition.
Remote Acquisition with ProDiscover
ProDiscover Incident Response is designed to be integrated as a network intrusion analysis
tool and is useful for performing remote acquisitions. When connected to a remote computer,
it uses the same ProDiscover acquisition method described previously. After the connection is
established, the remote computer is displayed in the Capture Image dialog box. This tool
offers all the functions and features of other tools in the ProDiscover suite plus the following:
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Remote Network Acquisition Tools
123
•
Capture volatile system state information.
•
Analyze current running processes on a remote system.
•
Locate unseen files and processes on a remote system that might be running malware
or spyware.
•
Remotely view and listen to IP ports on a compromised system.
•
Run hash comparisons on a remote system to search for known Trojans and rootkits.
•
Create a hash inventory of all files on a system remotely (a negative hash search
capability) to establish a baseline if it gets attacked.
The ProDiscover utility for remote access is the PDServer remote agent, which must be loaded
on the suspect computer before ProDiscover Incident Response can access it. This remote
agent can be installed in three different ways:
•
Trusted CD—For this manual installation method, ProDiscover can create a special
CD/DVD or USB drive containing the PDServer remote agent. It’s used to load
PDServer manually on the suspect computer.
•
Preinstallation—For networks with a configured OS, the PDServer remote agent can
be added to the standard installation of high-risk computers, which enables network
security administrators to respond to network attacks and malware contaminations
quickly. Any network management tool, such as DameWare (www.dameware.com)
or Hyena (www.systemtools.com/hyena/), can be used to initiate a connection with
ProDiscover. This is a remote method of installing the remote acquisition tool.
•
Pushing out and running remotely—Downloading PDServer to a remote computer
helps investigators respond quickly to incidents. Data is collected in real time
when using this function. This is a remote method of installing the remote
acquisition tool.
With PDServer, you have the option of running it in a stealth mode to hide it from the suspect. Note that Windows Task Manager lists the process as PDServer. To disguise it, you
can change the process name so that it appears to be an OS function in the suspect computer’s Task Manager. In addition, the following security features are available for remote
connections:
•
Password protection—PDServer on the target computer is password-protected, and the
password is encrypted at all times.
•
Encryption—All communication between PDServer on the suspect’s and investigator’s
computers can be encrypted. ProDiscover provides 256-bit Advanced Encryption
Standard (AES) or Twofish encryption for the connection.
•
Secure communication protocol—All connections between the suspect’s and examiner’s computers have globally unique identifiers (GUIDs) to prevent inserting packets
in the data stream.
•
Write-protected trusted binaries—PDServer can run from a write-protected device,
such as a CD.
•
Digital signatures—PDServer and its removal device driver, PARemoval.sys, are
digitally signed to verify that they haven’t been tampered with before and during the
remote connection.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
124
Chapter 3
For more information on ProDiscover and PDServer, see
www.techpathways.com.
Remote Acquisition with EnCase Enterprise
Guidance Software was the first forensics vendor to develop a remote acquisition and analysis
tool based on its desktop tool EnCase. This remote tool, EnCase Enterprise, comes with several capabilities. The following are some of its remote acquisition features:
•
Remote data acquisition of a computer’s media and RAM data
•
Integration with intrusion detection system (IDS) tools that copy evidence of intrusions
to an investigation workstation automatically for further analysis over the network
•
Options to create an image of data from one or more systems
•
Preview of systems to determine whether future actions, such as an acquisition, are
needed
•
A wide range of file system formats, such as NTFS, FAT, Ext2/3, Reiser, Solaris UFS,
AIX Journaling File System (JFS), LVM8, FFS, Palm, Macintosh HFS/HFS1, CDFS,
ISO 9660, UDF, DVD, and more
•
RAID support for both hardware and software
EnCase Enterprise is set up with an Examiner workstation and a Secure Authentication for
EnCase (SAFE) workstation. Acquisition and analysis are conducted on the Examiner workstation. The SAFE workstation provides secure encrypted authentication for the Examiner
workstation and the suspect’s system.
The remote access program in EnCase Enterprise is Servlet, a passive utility installed on the
suspect computer. Servlet connects the suspect computer to the Examiner and SAFE workstations and can run in stealth mode on the suspect computer.
Remote Acquisition with R-Tools R-Studio
The R-Tools suite of software is designed for data recovery. As part of this recovery capability,
the R-Studio network edition can remotely access networked computer systems. Its remote connection uses Triple Data Encryption Standard (3DES) encryption. Data acquired with R-Studio
network edition creates raw format acquisitions, and it’s capable of recovering many different
file systems, including ReFS. For more information on R-Studio, see www.r-tt.com.
Remote Acquisition with WetStone US-LATT PRO
US-LATT PRO, part of a suite of tools developed by WetStone, can connect to a networked
computer remotely and perform a live acquisition of all drives connected to it. For more information on this tool, see www.wetstonetech.com/product/14.
Remote Acquisition with F-Response
F-Response is a vendor-neutral specialty remote access utility designed to work with any digital forensics program. When installed on a remote computer, it sets up a security read-only
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Other Forensics Acquisition Tools
125
connection that allows forensics examiners to access it. With F-Response, examiners can
access remote drives at the physical level and view raw data. After the F-Response connection
has been set up, any forensics acquisition tool can be used to collect digital evidence.
F-Response is sold in four different versions: Enterprise Edition, Consultant 1 Convert Edition, Consultant Edition, and TACTICAL Edition. For the latest information on F-Response,
see www.f-response.com.
Using Other Forensics Acquisition Tools
In addition to ProDiscover, FTK Imager, and X-Ways Forensics, you can use other commercial acquisition tools, described in the following sections. Prices for some tools are discounted
for law enforcement officers working in digital forensics.
PassMark Software ImageUSB
PassMark Software has an acquisition tool called ImageUSB for its OSForensics analysis
product. To create a bootable flash drive, you need Windows XP or later and ImageUSB
downloaded from the OSForensics Web site. For more information on ImageUSB, see
www.osforensics.com/tools/write-usb-images.html.
ASRData SMART
ASRData SMART is a Linux forensics analysis tool that can make image files of a suspect
drive. SMART can produce proprietary or raw format images and includes the following
capabilities:
•
Robust data reading of bad sectors on drives
•
Mounting suspect drives in write-protected mode
•
Mounting target drives, including NTFS drives, in read/write mode
•
Optional compression schemes to speed up acquisition or reduce the amount of storage
needed for acquired digital evidence
For more information on SMART, see www.asrdata.com.
Runtime Software
In addition to RAID Reconstructor, Runtime Software offers several compact shareware
programs for data acquisition and recovery, including DiskExplorer for FAT and DiskExplorer
for NTFS. Runtime has designed its tools to be file system specific, so DiskExplorer versions
for both FAT and NTFS are available. These tools offer the following features for acquisition
needs:
•
Create a raw format image file.
•
Segment the raw format or compressed image for archiving purposes.
•
Access network computers’ drives.
For more information on Runtime Software, see www.runtime.org.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
126
Chapter 3
ILookIX Investigator IXimager
IXimager runs from a bootable thumb drive or CD/DVD. It’s a stand-alone proprietary format
acquisition tool designed to work only with ILookIX Investigator. It can acquire single drives
and RAID drives. It supports IDE (PATA), SCSI, USB, and FireWire devices. The IXimager
proprietary format can be converted to a raw format if other analysis tools are used. For more
information on IXimager, see www.perlustro.com/solutions/e-forensics/iximager.
SourceForge
SourceForge provides several applications for security, analysis, and investigations. For a listing of its current tools, see http://sourceforge.net/directory/security-utilities/storage/archiving/
os:windows/freshness:recently-updated. SourceForge also offers a Windows version of
dcfldd; for updates, go to http://dcfldd.sourceforge.net.
Chapter Summary
䊏
Forensics data acquisitions are stored in three different formats: raw, proprietary, and
AFF. Most proprietary formats and AFF store metadata about the acquired data in the
image file.
䊏
The four methods of acquiring data for forensics analysis are disk-to-image file, disk-todisk copy, logical disk-to-disk or disk-to-data file, or sparse data copy of a folder or file.
䊏
Lossless compression for forensics acquisitions doesn’t alter the data when it’s restored,
unlike lossy compression. Lossless compression can compress up to 50% for most data.
If data is already compressed on a drive, lossless compression might not save much
more space.
䊏
If there are time restrictions or too much data to acquire from large drives or RAID
drives, a logical or sparse acquisition might be necessary. Consult with your lead attorney or supervisor first to let them know that collecting all the data might not be possible.
䊏
You should have a contingency plan to ensure that you have a forensically sound acquisition and make two acquisitions if you have enough data storage. The first acquisition should be compressed, and the second should be uncompressed. If one acquisition
becomes corrupt, the other one is available for analysis.
䊏
Write-blocking devices or utilities must be used with GUI acquisition tools in both
Windows and Linux. Practice with a test drive rather than suspect drive, and use a
hashing tool on the test drive to verify that no data was altered.
䊏
Always validate your acquisition with built-in tools from a forensics acquisition program, a hexadecimal editor with MD5 or SHA-1 hashing functions, or the Linux
md5sum or sha1sum commands.
䊏
A Linux Live CD, such as SIFT, Kali Linux, or Deft, provides many useful tools for
digital forensics acquisitions.
䊏
The preferred Linux acquisition tool is dcfldd instead of dd because it was designed
for forensics acquisition. The dcfldd tool is also available for Windows. Always validate the acquisition with the hashing features of dcfldd and md5sum or sha1sum.
䊏
When using the Linux dd or dcfldd commands, remember that reversing the output
field (of¼) and input field (if¼) of suspect and target drives could write data to the
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Review Questions
127
wrong drive, thus destroying your evidence. If available, you should always use a physical write-blocker device for acquisitions.
䊏
To acquire RAID disks, you need to determine the type of RAID and which acquisition
tool to use. With a firmware-hardware RAID, acquiring data directly from the RAID
server might be necessary.
䊏
Remote network acquisition tools require installing a remote agent on the suspect computer. The remote agent can be detected if suspects install their own security programs,
such as a firewall.
Key Terms
Advanced Forensic Format (AFF) An open-source data acquisition format that stores image
data and metadata. File extensions include .afd for segmented image files and .afm for AFF
metadata.
host protected area (HPA) An area of a disk drive reserved for booting utilities and
diagnostic programs. It’s not visible to the computer’s OS.
live acquisitions A data acquisition method used when a suspect computer can’t be shut
down to perform a static acquisition. Captured data might be altered during the acquisition
because it’s not write-protected. Live acquisitions aren’t repeatable because data is
continually being altered by the suspect computer’s OS.
logical acquisition This data acquisition method captures only specific files of interest to the
case or specific types of files, such as Outlook .pst files. See also sparse acquisition.
raw format A data acquisition format that creates simple sequential flat files of a suspect
drive or data set.
redundant array of independent disks (RAID) Two or more disks combined into one large
drive in several configurations for special needs. Some RAID systems are designed for
redundancy to ensure continuous operation if one disk fails. Another configuration spreads
data across several disks to improve access speeds for reads and writes.
sparse acquisition Like logical acquisitions, this data acquisition method captures only
specific files of interest to the case, but it also collects fragments of unallocated (deleted) data.
See also logical acquisition.
static acquisitions A data acquisition method used when a suspect drive is write-protected
and can’t be altered. If disk evidence is preserved correctly, static acquisitions are repeatable.
whole disk encryption An encryption technique that performs a sector-by-sector encryption
of an entire drive. Each sector is encrypted in its entirety, making it unreadable when copied
with a static acquisition method.
Review Questions
1. What’s the main goal of a static acquisition?
2. Name the three formats for digital forensics data acquisitions.
3. What are two advantages and disadvantages of the raw format?
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
128
Chapter 3
4. List two features common with proprietary format acquisition files.
5. Of all the proprietary formats, which one is the unofficial standard?
6. Name two commercial tools that can make a forensic sector-by-sector copy of a drive to
a larger drive.
7. What does a logical acquisition collect for an investigation?
8. What does a sparse acquisition collect for an investigation?
9. What should you consider when determining which data acquisition method to use?
10. Why is it a good practice to make two images of a suspect drive in a critical investigation?
11. When you perform an acquisition at a remote location, what should you consider to prepare for this task?
12. With newer Linux kernel distributions, what happens if you connect a hot-swappable device, such a USB drive, containing evidence?
13. In a Linux shell, the fdisk -l command lists the suspect drive as /dev/hda1. Is the
following dcfldd command correct?
dcfldd if¼image_file.img of¼/dev/hda1
14. What’s the most critical aspect of digital evidence?
15. What is a hashing algorithm?
16. In the Linux dcfldd command, which three options are used for validating data?
17. What’s the maximum file size when writing data to a FAT32 drive?
18. What are two concerns when acquiring data from a RAID server?
19. With remote acquisitions, what problems should you be aware of? (Choose all that
apply.)
a. Data transfer speeds
b.
Access permissions over the network
c.
Antivirus, antispyware, and firewall programs
d.
The password of the remote computer’s user
20. How does ProDiscover Incident Response encrypt the connection between the examiner’s
and suspect’s computers?
21. What’s the ProDiscover remote access utility?
22. Which forensics tools can connect to a suspect’s remote computer and run
surreptitiously?
23. EnCase, FTK, SMART, and ILookIX treat an image file as though it were the original
disk. True or False?
24. FTK Imager can acquire data in a drive’s host protected area. True or False?
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
129
Hands-On Projects
If necessary, extract all data files in the Chap03nProjects folder on the book’s DVD to the
WorknChap03nProjects folder on your system. (Create this folder on your system before
starting the projects.)
Hands-On Project 3-1
In this project, you learn how to restore an image file to a drive. Subsequent
projects in this book require using these steps. To prepare for this project, you
need the following items:
• A USB or FireWire drive that can hold up to 100 MB or a secondary internally connected drive
• ProDiscover Basic installed on your workstation
• The GCFI-datacarve-FAT.eve data file (extracted from GCFI-datacarve-FAT.exe in the Chap03nProjects folder on the book’s DVD)
Data-Loading Procedure in ProDiscover Basic The first task
is to transfer data from the GCFI-datacarve-FAT.eve file to the target
drive. Follow these steps:
1. Boot your acquisition workstation.
2. Connect a hot-swappable media storage device to receive the data, such as
a 1001 MB USB drive, a FireWire drive, or an internally connected drive.
This device is referred to as the target drive.
3. Start ProDiscover Basic (running it as administrator), and in the main window, click Tools, Copy Disk from the menu.
4. In the Copy source disk or image to destination disk dialog box, click the
Image to Disk tab.
5. Click Browse next to the Image File text box, and navigate to the location
where you copied this chapter’s data files. Click the GCFI-datacarveFAT.eve file, and then click Open.
6. In the Copy source disk or image to destination disk dialog box, click in
the space under the Disk Name column at the bottom, as shown in
Figure 3-14.
7. Click the Disk Name list arrow, click the target drive, and then click OK.
8. In the Copy dialog box that opens, click the Write All 0’s option button,
and then click OK to start the data loading.
9. Click OK in the “Copy successful” message box to terminate the loading.
10. Exit ProDiscover Basic, shut down your acquisition workstation, and
remove the target drive.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
130
Chapter 3
Click to get
a list of
logical drives
Figure 3-14 The Copy source disk or image to destination disk dialog box
Courtesy of Technology Pathways, LLC
Hands-On Project 3-2
In this project, you make a ProDiscover image file of the data load in HandsOn Project 3-1. To prepare, you need to do the following:
• Make sure you have the suspect drive containing the data load from
Hands-On Project 3-1.
• Review the steps in “Using ProDiscover’s Raw Acquisition Format” for creating an image file.
• Verify that you have enough free space on your computer’s internal drive to
receive the image file (about 120 MB).
For the purposes of this project, you don’t need a
write-blocker. For actual casework, however, always
use a write-blocker.
To make this acquisition on an internally connected drive, follow these steps:
1. Use a write-blocking hardware device to protect the suspect drive.
2. Turn on your acquisition workstation.
3. Start ProDiscover. Follow the steps in this chapter for making a raw
format acquisition, making sure you click UNIX style dd format in the
Image Format drop-down list box. Then click OK in the Capture Image
dialog box.
4. When the acquisition is finished, exit ProDiscover. Shut down the acquisition workstation, remove the suspect drive, and secure it as evidence.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
131
Hands-On Project 3-3
In this project, you prepare a drive and create a FAT32 disk partition using
Linux. You need the following:
• A Linux distribution or Linux Live CD
• A disk drive
• A method of connecting a disk drive to your workstation, such as USB,
FireWire, external SATA, or internal connections, such as PATA or SATA
• A review of the steps in the “Preparing a Target Drive for Acquisition in
Linux” section
To format a drive as FAT32 in Linux, follow these steps:
1. Connect the target drive to be partitioned and formatted as FAT32 to your
workstation.
2. Start your workstation, and log on or boot the Linux Live CD.
3. Follow the steps in the “Preparing a Target Disk for Acquisition in Linux”
section.
4. When you’ve finished formatting the target drive, leave it connected for the
next project.
Hands-On Project 3-4
In this project, you use the Linux dd command to make an acquisition
split into 30 MB segmented volumes. Then you validate the data by using the
Linux md5sum command on the original drive and the image files. The output
for md5sum is then redirected to a data file kept with the image files. For this
project, you need the following:
• A Linux distribution or Linux Live CD
• The FAT32 drive partitioned and formatted in Hands-On Project 3-3
• A method of connecting the FAT32 drive and the drive created in HandsOn Project 3-1 to your workstation, such as USB, FireWire, external SATA,
or internal connections, such as PATA or SATA
• A review of the “Acquiring Data with dd in Linux” and “Validating dd
Acquired Data” sections
Follow these steps:
1. Make sure you’ve connected the drive you prepared in Hands-On Project
3-3 to your Linux workstation.
2. Start your workstation, if necessary, and log on to Linux or boot the Linux
Live CD.
3. Reboot the Linux system, and make the dd acquisition, following the steps
in “Acquiring Data with dd in Linux.” For the split -b command, make
the segmented size 30m, and use the -d switch to create numeric extensions
for each segmented file.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
132
Chapter 3
4. When the acquisition is done, perform a validation of the suspect drive and
the acquired image files. Follow the steps in the “Validating dd Acquired
Data” section. When you’re finished, close the shell window, and log off
Linux.
Case Projects
Case Project 3-1
Your supervisor has asked you to research current acquisition tools. Using
your preferred Internet search engine and the vendors listed in this chapter,
prepare a report containing the following information for each tool and stating
which tool you would prefer to use:
• Forensics vendor name
• Acquisition tool name and latest version number
• Features of the vendor’s product
With this data collected, prepare a spreadsheet listing vendors in the rows. For
the column headings, list the following features:
• Raw format
• Proprietary format
• AFF format
• Other proprietary formats the tool can read
• Compression of image files
• Remote network acquisition capabilities
• Method used to validate (MD5, SHA-1, and so on)
Case Project 3-2
At a murder scene, you have started making an image of a computer’s drive.
You’re in the back bedroom of the house, and a small fire has started in the
kitchen. If the fire can’t be extinguished, you have only a few minutes to acquire data from a 10 GB hard disk. Write one to two pages outlining your
options for preserving the data.
Case Project 3-3
You need to acquire an image of a disk on a computer that can’t be removed
from the scene, and you discover that it’s a Linux computer. What are your
options for acquiring the image? Write a brief paper specifying the hardware
and software you would use.
Case Project 3-4
A bank has hired your firm to investigate employee fraud. The bank uses four
20 TB machines on a LAN. You’re permitted to talk to the network
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Case Projects
133
administrator, who is familiar with where the data is stored. What diplomatic
strategies should you use? Which acquisition method should you use? Write a
two-page report outlining the problems you expect to encounter, explaining
how to rectify them, and describing your solution. Be sure to address any
customer privacy issues.
Case Project 3-5
You’re investigating a case involving a 2 GB drive that you need to copy at the
scene. Write one to two pages describing three options you have to copy the
drive accurately. Be sure to include your software and media choices.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
3
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
chapter
4
Processing Crime
and
Incident Scenes
After reading this chapter and completing
the exercises, you will be able to:
• Explain the rules for controlling digital evidence
• Describe how to collect evidence at private-sector incident scenes
• Explain guidelines for processing law enforcement crime scenes
• List the steps in preparing for an evidence search
• Describe how to secure a computer incident or crime scene
• Explain guidelines for seizing digital evidence at the scene
• List procedures for storing digital evidence
• Explain how to obtain a digital hash
• Review a case to identify requirements and plan your investigation
135
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
136
Chapter 4
In this chapter, you learn how to process a digital investigation scene. Because this
chapter focuses on investigation needs for computing systems and digital devices, you should
supplement your training by studying police science or U.S. Department of Justice (DOJ) procedures to understand field-of-evidence recovery tasks. If you’re in another country, be aware
of laws relating to privacy, searches, and the rules of evidence for your region. In addition,
consult local authorities, and refer to the excellent guidelines in ISO standard 27037 (introduced in Chapter 1).
Evidence rules are critical, whether you’re on a corporate or a criminal case. As you’ll see, a
civil case can quickly become a criminal case, and a criminal case can have civil implications
larger than the criminal case. This chapter examines rules of evidence in the United States,
but similar procedures apply in most courts worldwide. This chapter also describes differences between a business (private entity) and a law enforcement organization (public entity)
in needs and concerns and discusses incident-scene processing for both types of investigations. Private-sector security officers often begin investigating corporate digital crimes and
then coordinate with law enforcement as they complete the investigation. Law enforcement
investigators should, therefore, know how to process and manage incident scenes. Because
public agencies usually don’t have the funding to train officers continuously in technology
advances, they must learn to work with private-sector investigators, whose employers can often afford to maintain their investigators’ computing skills.
This chapter also discusses how the Fourth Amendment relates to corporate and law enforcement digital investigations in the United States. Many countries have similar statutes or charters. As the world becomes more global or “flat” in nature, you need to be aware of how
laws are interpreted in other countries. In addition, the laws must be applied consistently as
more countries establish e-laws and more cases go to court. Cases of fraud and money laundering are becoming more of a global issue, and crimes against consumers can originate from
anywhere in the world. Computers and digital evidence seized in one jurisdiction might affect
a case that’s worldwide in scope.
To address these issues, this chapter explains how to apply standard crime scene practices
and rules for handling evidence to corporate and law enforcement digital investigations. You
must handle digital evidence systematically so that you don’t inadvertently alter or lose data.
In addition, you should apply the same security controls to evidence for a civil lawsuit as evidence for a major crime. Federal and state rules of evidence govern both civil and criminal
cases. However, the restrictions on how the government can proceed, as opposed to a private
company, are much stricter. For example, as long as a policy exists, a company doesn’t need
a search warrant to examine a company-owned machine; however, the government would.
These rules are similar in English-speaking countries because they have a common ancestor
in English common law (judge-made law), dating back to the late Middle Ages.
Identifying Digital Evidence
Digital evidence can be any information stored or transmitted in digital form. Because you
can’t see or touch digital data directly, it’s difficult to explain and describe. Is digital evidence
real or virtual? Does data on a disk or other storage medium physically exist, or does it merely
represent real information? U.S. courts accept digital evidence as physical evidence, which
means digital data is treated as a tangible object, such as a weapon, paper document, or visible
injury, that’s related to a criminal or civil incident. In addition, the ISO standard 27037 gives
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Identifying Digital Evidence
137
guidance on what procedures countries should have in place for digital evidence. However,
each country has its own interpretation of what can or can’t be presented in court or accepted
as evidence. Some countries used to require that all digital evidence be printed to be presented
in court. Groups such as the Scientific Working Group on Digital Evidence (SWGDE;
www.swgde.org) set standards for recovering, preserving, and examining digital evidence.
For more information on digital evidence, go to https://www.ncjrs.gov/
pdffiles1/nij/219941.pdf and read “Electronic Crime Scene Investigation:
A Guide for First Responders, 2nd edition,” which has guidelines for
U.S. law enforcement and other responders who protect an electronic
crime scene and search for, collect, and preserve electronic evidence.
Following are the general tasks investigators perform when working with digital evidence:
•
Identify digital information or artifacts that can be used as evidence.
•
Collect, preserve, and document evidence.
•
Analyze, identify, and organize evidence.
•
Rebuild evidence or repeat a situation to verify that the results can be reproduced
reliably.
Collecting digital devices while processing a criminal or incident scene must be done systematically. To minimize confusion, reduce the risk of losing evidence, and avoid damaging evidence, only one team should collect and catalog digital evidence at a crime scene or lab, if
practical. If there’s too much evidence or too many systems to make it practical for one team
to perform these tasks, all examiners must follow the same established operating procedures,
and a lead or managing examiner should control collecting and cataloging evidence. You
should also use standardized forms (discussed later in “Documenting Evidence”) for tracking
evidence to ensure that you consistently handle evidence in a safe, secure manner.
An important challenge investigators face today is establishing recognized standards for digital evidence. For example, there are cases involving police raids being conducted simultaneously in many countries as well as anti-cartel investigations taking place in several locations
around the world. As a result, you have multiple sites where evidence was seized and hundreds of pieces of digital evidence, including hard drives, cell phones, and other storage
devices. If law enforcement and civil organizations in these countries have agreed on proper
procedures (generally, the highest control standard should be applied to evidence collection
in all jurisdictions), the evidence can be presented in any jurisdiction confidently.
Understanding Rules of Evidence
Consistent practices help verify your work and enhance your credibility, so you must handle
all evidence consistently. Apply the same security and accountability controls for evidence in
a civil lawsuit as in a major crime to comply with your state’s rules of evidence or with the
Federal Rules of Evidence (FRE). Also, keep in mind that evidence admitted in a criminal case
might also be used in a civil suit, and vice versa. For example, suppose someone is charged
with murder and acquitted at the criminal trial because the jury isn’t convinced beyond a reasonable doubt of the person’s guilt. If enough evidence shows that the accused’s negligence
contributed to a wrongful death, however, the victim’s relatives can use the evidence in a civil
lawsuit to recover damages.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
138
Chapter 4
You can review the Federal Rules of Evidence at www.uscourts.gov/
uscourts/rules/rules-evidence.pdf.
As part of your professional growth, keep current on the latest rulings and directives on collecting, processing, storing, and admitting digital evidence. The following sections discuss
some key concepts of digital evidence. You can find additional information at the U.S.
Department of Justice Web site (www.usdoj.gov) and by searching the Internet for “digital
evidence,” “best evidence rule,” “hearsay,” and other relevant keywords. Consult with your
prosecuting attorney, Crown attorney, corporate general counsel, or the attorney who
retained you to learn more about managing evidence for your investigation.
In Chapter 2, you learned how to make an image of a disk as part of gathering digital
evidence. The data you discover from a forensic examination falls under your state’s rules
of evidence or the FRE. However, digital evidence is unlike other physical evidence because it
can be changed more easily. The only way to detect these changes is to compare the original
data with a duplicate. Furthermore, distinguishing a duplicate from the original electronically
is challenging, so digital evidence requires special legal consideration.
If you’re working in a country outside the United States, you need to
verify its rules of evidence for electronic evidence.
Another concern when dealing with digital records is the concept of hearsay, which is a statement made while testifying at a hearing by someone other than an actual witness to the event.
For example, a rumor has been circulating around an office about an incident, or a friend
mentioned it to the person being questioned; both situations would be considered hearsay. The
concept of what is or isn’t hearsay can become particularly challenging when examining the
contents of documents, text messages, e-mails, and other electronic files. The fact that the documents or text messages exist can’t be disputed; however, the contents require eyewitness testimony or corroborating evidence. The definition of hearsay isn’t difficult to understand, but it
can become confusing when considering all the exceptions to the general rule against hearsay.
Like most common law nations, the United States excludes hearsay as spelled out in the FRE
Article VIII, Rule 802. Rules 803 and 804 cite more than 20 exceptions for when hearsay can
be used. The following are some that apply to digital forensics investigations:
•
Business records, including those of a public agency
•
Certain public records and reports
•
Evidence of the absence of a business record or entry
•
Learned treatises used to question an expert witness
•
Statements of the absence of a public record or entry
To see more exceptions to the hearsay rule, consult sources such as
www.FindLaw.com.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Identifying Digital Evidence
139
The business-record exception, for example, allows “records of regularly conducted activity,”
such as business memos, reports, records, or data compilations. Business records are authenticated by verifying that they were created “at or near the time by, or from information transmitted by, a person with knowledge …” and are admissible “if the record was kept in the
course of a regularly conducted business activity, and it was the regular practice of that business
activity to make the record” (FRE, 803(6); see Section V, “Evidence,” in Searching and Seizing
Computers and Obtaining Electronic Evidence in Criminal Investigations, www.justice.gov/
criminal/cybercrime/docs/ssmanual2009.pdf ).
In other common law countries, a distinction is made between “real computer evidence” and
“hearsay computer evidence.” A simplified explanation of the condition states that you can,
for example, prove an e-mail was sent and perhaps opened by a logged-in user. However,
you can’t necessarily verify the e-mail’s contents. Generally, digital records are considered
admissible if they qualify as a business record.
Another way of categorizing computer records is by dividing them into computer-generated
records and computer-stored records. Computer-generated records are data the system
maintains, such as system log files and proxy server logs. They are output generated from
a computer process or algorithm, not usually data a person creates. Computer-stored records,
however, are electronic data that a person creates and saves on a computer or digital device,
such as a spreadsheet or word processing document. Some records combine computergenerated and computer-stored evidence, such as a spreadsheet containing mathematical
operations (computer-generated records) generated from a person’s input (computer-stored
records).
Computer and digitally stored records must also be shown to be authentic and trustworthy
to be admitted into evidence. Computer-generated records are considered authentic if the program that created the output is functioning correctly. These records are usually considered
exceptions to the hearsay rule. For computer-stored records to be admitted into court, they
must also satisfy an exception to the hearsay rule, usually the business-record exception,
so they must be authentic records of regularly conducted business activity. To show that
computer-stored records are authentic, the person offering the records must demonstrate that
a person created the data and the data is reliable and trustworthy—in other words, that it
wasn’t altered when it was acquired or afterward.
Collecting evidence according to approved steps of evidence control helps ensure that the
computer evidence is authentic, as does using established forensics software tools. Courts
have consistently ruled that forensics investigators don’t have to be subject matter experts
on the tools they use. In United States v. Salgado (250 F.3d 438, 453, 6th Cir., 2001), the
court stated, “It is not necessary that the computer programmer testify in order to authenticate computer-generated records.” In other words, the witness must have firsthand knowledge only of facts relevant to the case. If you have to testify about your role in acquiring,
preserving, and analyzing evidence, you don’t have to know the inner workings of the tools
you use, but you should understand their purpose and operation. For example, Message
Digest 5 (MD5) and Secure Hash Algorithm (SHA-1) tools use complex algorithms. During
a cross-examination, an opposing attorney might ask you to describe how these forensics
tools work. You can safely testify that you don’t know how the MD5 hashing algorithm
works, but you can describe the steps for using the MD5 function in OSForensics, for
instance.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
140
Chapter 4
Even though research has forced collisions (meaning duplicate values)
of the MD5 hash, it’s still useful for forensic validation. Keep in mind
that you can’t generate the source string from the hash value. In addition, the probability of collisions affecting a case is remote.
When attorneys challenge digital evidence, often they raise the issue of whether computergenerated records were altered or damaged after they were created. In the case of American
Express v. Vinhnee (9th Cir. Bk. App. Panel, 2005), the judge determined that American
Express hadn’t established that the records presented in court were authentic and the same as
the original bill sent to Mr. Vinhnee. The company lost on appeal, too. Attorneys might also
question the authenticity of computer-generated records by challenging the program that created them. To date, courts have been skeptical of unsupported claims about digital evidence.
Asserting that the data changed without specific evidence isn’t sufficient grounds to discredit
the digital evidence’s authenticity. Most federal courts that evaluate digital evidence from
computer-generated records assume that the records contain hearsay. Federal courts then
apply the business-records exception to hearsay as it relates to digital evidence.
As mentioned, one test to prove that computer-stored records are authentic is to demonstrate
that a specific person created the records. Establishing who created digital evidence can be
difficult, however, because records recovered from slack space or unallocated disk space usually don’t identify the author. The same is true for other records, such as anonymous e-mail
messages or text messages from instant-messaging programs. To establish authorship of digital evidence in these cases, attorneys can use circumstantial evidence, which requires finding
other clues associated with the suspect’s computer or location. The circumstantial evidence
might be that the computer has a password consistent with the password the suspect used on
other systems, a witness saw the suspect at the computer at the time the offense occurred, or
additional trace evidence associates the suspect with the computer at the time of the incident.
In a recent case, the attorney chose not to use the digital evidence because although it could
be proved that a particular camera was used to create the suspect’s movies, CDs, and DVDs,
there was no way to prove that the suspect was the person using the camera. Therefore, there
was no circumstantial or corroborating evidence to prove that the suspect was guilty.
Although some files might not contain the author’s name, in the arrest of the BTK strangler,
the author of a Microsoft Word document was identified by using file metadata. In February
2005, the man claiming to be the BTK strangler sent a floppy disk to FOX News in Wichita.
The police he had been taunting told him that they wouldn’t be able to trace him via the
floppy disk. Forensics examination of the disk came back with the name of the church and a
user named Dennis, who turned out to be Dennis Rader, president of the congregation. The
police had enough physical evidence to link him to the crimes. They arrested him, and he confessed to the murders of 10 people over the course of 30 years. He was sentenced to 10 life
terms. (For the full story, visit the TruTV Web site at www.crimelibrary.com/serial killers/
unsolved/btk/index 1.html.)
The following activity shows an easy way to identify this file metadata. Follow these steps in
the demo version of OSForensics:
These steps are designed for OSForensics, which is included on this
book’s DVD. If you haven’t installed it, do so now. In addition, create
a WorknChap04nChapter work folder on your system.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Identifying Digital Evidence
141
1. Start Microsoft Word, and in a new document, type By creating a file, you
can identify the author with file metadata. Save it in your work folder as
InChap04-01.docx (or InChap04-01.doc in earlier Word versions), and
then exit Microsoft Word.
2. To start OSForensics in Windows 7 or earlier, click Start, point to All Programs, click
the OSForensics folder, and click OSForensics. In Windows 8 or 8.1, go to the Start
screen and click OSForensics. If Windows prompts you to confirm that you trust this
program, click OK or Yes.
3. If you see a message asking whether you want to upgrade to the professional version,
click the Continue Using Free Version button.
4. In the OSForensics main window, notice the Viewers section in the right pane. Click
File and Hex Viewer. In the “Select a file to open” dialog box that opens, navigate to
your work folder and double-click the file you created in Step 1.
5. The dialog box that opens (see Figure 4-1) has five tabs. Click the File Info tab, where
you can see where the file is located along with the date and time it was created. Notice
that the file size and its size on the disk are different.
Figure 4-1 Examining a file in OSForensics
Source: PassMark Software, www.osforensics.com
6. Click the Metadata tab. The information in this tab includes file permissions, file type,
file size, and other items. Scroll to the bottom of this tab, where you can see who
created the file and who last modified the file (see Figure 4-2).
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
142
Chapter 4
Figure 4-2 Viewing file metadata
Source: PassMark Software, www.osforensics.com
7. Close the dialog box, and exit OSForensics by scrolling to the bottom of the left pane
and clicking the Exit button.
In addition to revealing the author, computer-stored records must be proved authentic, which
is the most difficult requirement to prove when you’re trying to qualify evidence as an exception to the hearsay rule. The process of establishing digital evidence’s trustworthiness originated with written documents and the “best evidence rule,” which states that to prove the
content of a written document, recording, or photograph, ordinarily the original writing,
recording, or photograph is required (as stated in Article X, Rule 1001, of the FRE). In addition, the original of a document is preferred to a duplicate. The best evidence, therefore, is
the document created and saved on a computer’s hard disk. However, Rule 1001, section (e),
defines a duplicate done in a manner, including electronic, that “accurately reproduces the
original.” Rule 1003 states that the duplicate can be used unless the original’s authenticity is
challenged.
Agents and prosecutors occasionally express concern that a printout of a computer-stored
electronic file might not qualify as an original document, according to the best evidence rule.
In its most fundamental form, the original file is a collection of 0s and 1s; in contrast, the
printout is the result of manipulating the file through a complicated series of electronic and
mechanical processes (FRE, 803(6); see Searching and Seizing from Computers and Obtaining Electronic Evidence in Criminal Investigations, 2009). To address this concern about
original evidence, the FRE states: “[I]f data are stored in a computer or similar device, any
printout or other output readable by sight, shown to reflect the data accurately, is an
‘original.’” Instead of producing hard disks in court, attorneys can submit printed copies of
files as evidence. In contrast, some countries used to allow only the printed version to be
presented in court, not hard disks.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Collecting Evidence in Private-Sector Incident Scenes
143
In addition, the FRE allows duplicates instead of originals when the duplicate is “produced by
the same impression as the original … by mechanical or electronic re-recording … or by other
equivalent techniques which accurately reproduce the original.” Therefore, as long as bit-stream
copies of data are created and maintained correctly, the copies can be admitted in court,
although they aren’t considered best evidence. The copied evidence can be a reliable working
copy, but it’s not considered the original. Courts understand that the original evidence might not
be available, however. For example, you could make one image of the evidence drive successfully
but lose access to the original drive because it has a head crash when you attempt to make a
backup image. Your first successful copy then becomes secondary evidence. The attorney must
be able to explain to the judge that circumstances beyond the examiner’s control resulted in loss
of the original evidence; in this case, the hard drive is no longer available to be examined or
imaged. Mishaps with evidence happen routinely in all aspects of evidence recovery; the majority
are caused by user error. Adhering to approved procedures can help prevent these mishaps.
Another example of not being able to use original evidence is investigations involving network
servers. Removing a server from the network to acquire evidence data could cause harm to a
business or its owner, who might be an innocent bystander to a crime or civil wrong. For example, Steve Jackson Games was the innocent party in a case in which evidence of criminal activity
had been stored in e-mail on company computers. The network administrator had reported evidence of a crime committed by users of the company’s bulletin board system (BBS) to the Secret
Service. Secret Service agents seized all the computers at Steve Jackson Games and effectively put
the company out of business. Steve Jackson Games sued the Secret Service, which was found
liable for damages under the Privacy Protection Act and Title II of the Electronic Communications Privacy Act. For more information, see Steve Jackson Games v. United States Secret Service
and United States of America (36 F.3d 457, USCA 5, 1994). In this situation, you might not
have the authority to create an image or remove the original drive. Instead, make your best effort
to acquire the digital evidence with a less intrusive or disruptive method. In this context, the
recovered materials become the best evidence because of the circumstances.
In summary, computer-generated records, such as system logs or the results of a mathematical formula in a spreadsheet, aren’t hearsay. Computer-stored records that a person generates
are subject to rules governing hearsay, however. For the evidence to qualify as a businessrecord exception to the hearsay rule, a person must have created the computer-stored records,
and the records must be original. The FRE treats images and printouts of digital files as
original evidence.
Collecting Evidence in Private-Sector Incident Scenes
Private-sector organizations include small to medium businesses, large corporations, and
non-government organizations (NGOs), which might get funding from the government or
other agencies. In the United States, NGOs and similar agencies must comply with state
public disclosure and federal Freedom of Information Act (FOIA) laws and make certain
documents available as public records. State public disclosure laws define state public records
as open and available for inspection. For example, divorces recorded in a public office, such
as a courthouse, become matters of public record unless a judge orders the documents sealed.
Anyone can request a copy of a public divorce decree. Figure 4-3 shows an excerpt of a
public disclosure law for the state of Idaho.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
144
Chapter 4
Figure 4-3 Idaho public disclosure law
ª Cengage Learningâ
State public disclosure laws apply to state records, but the FOIA allows citizens to request
copies of public documents created by federal agencies. The FOIA was originally enacted in
the 1960s, and several subsequent amendments have broadened its laws. Some Web sites
now provide copies of publicly accessible records for a fee.
A special category of private-sector businesses is ISPs and other communication companies.
ISPs can investigate computer abuse committed by their employees but not by customers. ISPs
must preserve customer privacy, especially when dealing with e-mail. However, federal regulations related to the Homeland Security Act and the PATRIOT Act of 2001 have redefined
how ISPs and large corporations operate and maintain their records. ISPs and other communication companies can be called on to investigate customers’ activities that are deemed to
create an emergency situation. An emergency situation under the PATRIOT Act is defined as
the immediate risk of death or personal injury, such as finding a bomb threat in an e-mail.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Collecting Evidence in Private-Sector Incident Scenes
145
As recent events have shown, the government monitors e-mails for the occurrence of keywords. Incidents such as the Edward Snowden case have made public the amount of electronic surveillance done by the U.S. government and the governments of other countries.
Some provisions of these federal regulations have been revised over the past few years, so you
should stay abreast of their implications.
Investigating and controlling computer incident scenes in corporate environments is much
easier than in crime scenes. In the private sector, the incident scene is often a workplace, such
as a contained office or manufacturing area, where a policy violation is being investigated.
Everything from the computers used to violate a company policy to the surrounding facility
is under a controlled authority—that is, company management. Typically, businesses have
inventory databases of computer hardware and software. Having access to these databases
and knowing what applications are on suspected computers help identify the forensics
tools needed to analyze a policy violation and the best way to conduct the analysis. For
example, companies might have a preferred Web browser, such as Microsoft Internet
Explorer, Mozilla Firefox, or Google Chrome. Knowing which browser a suspect used helps
you develop standard examination procedures to identify data downloaded to the suspect’s
workstation.
To investigate employees suspected of improper use of company digital assets, a company
policy statement about misuse of digital assets allows corporate investigators to conduct
covert surveillance with little or no cause and access company computer systems and digital
devices without a warrant, which is an advantage for corporate investigators. Law enforcement investigators can’t do the same, however, without sufficient reason for a warrant.
However, if a company doesn’t display a warning banner or publish a policy stating that it
reserves the right to inspect digital assets at will, employees have an expectation of privacy
(as explained in Chapter 1). When an employee is being investigated, this expected privacy
prevents the employer from legally conducting an intrusive investigation. A well-defined corporate policy, therefore, should state that an employer has the right to examine, inspect, or
access any company-owned digital assets. If a company issues a policy statement to all
employees, the employer can investigate digital assets at will without any privacy right restrictions; this practice might violate the privacy laws of countries in the EU, for example. As a
standard practice, companies should use both warning banners and policy statements. For
example, if an incident is escalated to a criminal complaint, prosecutors prefer showing juries
warning banners instead of policy manuals. A warning banner leaves a much stronger
impression on a jury.
In addition to making sure a company has a policy statement or a warning banner, corporate
investigators should know under what circumstances they can examine an employee’s computer. With a policy statement, an employer can freely initiate any inquiry necessary to protect the company or organization. However, organizations must also have a well-defined
process describing when an investigation can be initiated. At a minimum, most company policies require that employers have a “reasonable suspicion” that a law or policy is being violated. For example, if a policy states that employees can’t use company computers for outside
business and a supervisor notices a change in work behavior that could indicate an employee
is violating this rule, generally it’s enough to warrant an investigation. However, some
countries require notifying employees that they’re being investigated if they’re suspected of
criminal behavior at work.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
146
Chapter 4
If a corporate investigator finds that an employee is committing or has committed a crime,
the employer can file a criminal complaint with the police. Some businesses, such as banks,
have a regulatory requirement to report crimes. In the United States, the employer must turn
over all evidence to the police for prosecution. If this evidence had been collected by a law
enforcement officer, it would require a warrant, which would be difficult to obtain without
sufficient probable cause. In “Processing Law Enforcement Crime Scenes” later in this
chapter, you learn more about probable cause and how it applies to a criminal investigation.
Employers are usually interested in enforcing company policy, not seeking out and prosecuting employees, so typically they approve digital investigations only to identify employees who
are misusing company assets. Corporate investigators are, therefore, concerned mainly with
protecting company assets, such as intellectual property. Finding evidence of a criminal act
during an investigation escalates the investigation from an internal civil matter to an external
criminal complaint. In some situations, such as the discovery of child pornography or identity
theft, the company or its agents must notify law enforcement immediately.
If you discover evidence of a crime during a company policy investigation, first determine
whether the incident meets the elements of criminal law. You might have to consult with your
corporate attorney to determine whether the situation is a potential crime. Next, inform management of the incident; they might have other concerns, such as protecting confidential business data that might be included with the criminal evidence (called “commingled data”). In
this case, coordinate with management and the corporate attorney to determine the best way
to protect commingled data. After you submit evidence containing sensitive information to
the police, it becomes public record. Public record laws do include exceptions for protecting
sensitive corporate information; ultimately, however, a judge decides what to protect.
After you discover illegal activity and document and report the crime, stop your investigation
to make sure you don’t violate Fourth Amendment restrictions on obtaining evidence. If
the information you supply is specific enough to meet the criteria for a search warrant, the
police are responsible for obtaining a warrant that requests any new evidence. If you follow
police instructions to gather additional evidence without a search warrant after you have
reported the crime, you run the risk of becoming an agent of law enforcement. Instead, consult with your corporate attorney on how to respond to a police request for information. The
police and prosecutor should issue a subpoena for any additional new evidence, which minimizes your exposure to potential civil liability. In addition, you should keep all documentation of evidence collected to investigate an internal company policy violation. Later in this
section, you learn more about using affidavits in an internal investigation.
One example of a company policy violation involves employees observing another employee
accessing pornographic Web sites. If your organization’s policy requires you to determine
whether any evidence supports this accusation, you could start by extracting log file data
from the proxy server (used to connect a company LAN to the Internet) and conducting a
forensic examination of the subject’s computer. Suppose that during your examination, you
find adult and child pornography. Further examination of the subject’s hard disk reveals that
the employee has been collecting child pornography in separate folders on his workstation’s
hard drive. In the United States, possessing child pornography is a crime under federal and
state criminal statutes. These situations aren’t uncommon and make life difficult for investigators who don’t want to be guilty of possession of contraband, such as child pornography, on
their forensic workstations.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Processing Law Enforcement Crime Scenes
147
You survey the remaining content of the subject’s drive and find that he’s a lead engineer for
the team developing your company’s latest high-tech bicycle. He placed the child pornography images in a subfolder where the bicycle plans are stored. By doing so, he has commingled
contraband with the company’s confidential design plans for the bicycle. Your discovery
poses two problems in dealing with this contraband evidence. First, you must report the
crime to the police; all U.S. states and most countries have legal and moral codes when evidence of sexual exploitation of children is found. Second, you must also protect sensitive
company information. Letting the high-tech bicycle plans become part of the criminal evidence might make it public record, and the design work will then be available to competitors.
Your first step is to ask your corporate attorney how to deal with the commingled contraband data and sensitive design plans.
Your next step is to work with the corporate attorney to write an affidavit confirming your
findings. The attorney should indicate in the affidavit that the evidence is commingled with
company secrets and releasing the information will be detrimental to the company’s financial
health. When the affidavit is completed, you sign it before a notary, and then deliver the affidavit and the recovered evidence with log files to the police, where you make a criminal complaint. At the same time, the corporate attorney goes to court and requests that all evidence
recovered from the hard disk that’s not related to the complaint and is a company trade
secret be protected from public viewing. You and the corporate attorney have reported the
crime and taken steps to protect the sensitive data.
Now suppose the detective assigned to the case calls you. In the evidence you’ve turned over
to the police, the detective notices that the suspect is collecting most of his contraband from
e-mail attachments. The prosecutor needs you to collect more evidence to determine whether
the suspect is transmitting contraband pictures to other potential suspects. The detective realizes that collecting more evidence might make you an agent of law enforcement and violate
the employee’s Fourth Amendment rights, so she writes an affidavit for a search warrant,
ensuring that any subsequent instructions to you are legal. Before collecting any additional
information, you wait until you or your corporate attorney get a subpoena, search warrant,
or other court order.
Processing Law Enforcement Crime Scenes
To process a crime scene correctly, you must be familiar with criminal rules of search and
seizure. You should also understand how a search warrant works and what to do when you
process one. For all criminal investigations in the United States, the Fourth Amendment limits
how governments search and seize evidence. A law enforcement officer can search for and
seize criminal evidence only with probable cause. Probable cause refers to the standard specifying whether a police officer has the right to make an arrest, conduct a personal or property
search, or obtain a warrant for arrest. With probable cause, a police officer can obtain a
search warrant from a judge that authorizes a search and the seizure of specific evidence
related to the criminal complaint.
The Fourth Amendment states that only warrants “particularly describing the place to be
searched and the persons or things to be seized” can be issued. Note that this excerpt uses the
word “particularly.” The courts have determined that this phrase means a warrant can
authorize a search only of a specific place for a specific thing. Without specific evidence and
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
148
Chapter 4
the description of a particular location, a warrant might be weak and create problems later
during prosecution. For example, stating that the evidence is in a house on Elm Avenue
between Broadway and Main Street is too general, unless only one house fits that description,
because several houses might be located in this area. Instead, provide specific information,
such as “123 Elm Avenue.” Most courts have allowed more general wording for digital evidence, however. For example, you can state that you want to seize a “computer and all associated parts” instead of specifying a “Dell Optiplex GXA.” The DOJ document “Searching
and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations”
(www.justice.gov/criminal/cybercrime/docs/ssmanual2009.pdf, 2009) has an example of a
search warrant affidavit for computer searches on premises.
Although several court cases have allowed latitude when searching and seizing digital evidence, making your warrant as specific as possible to avoid challenges from defense attorneys
is a good practice. Often a warrant is written and issued in haste because of the nature of the
investigation. Law enforcement officers might not have the time to research the correct language for stating the nature of the complaint to meet probable cause requirements. However,
because a judge can exclude evidence obtained from a poorly worded warrant, you should
review these issues with your local prosecutor before investigating a case.
Understanding Concepts and Terms Used in Warrants
You should be familiar with warrant terminology that governs the type of evidence that can
be seized. Many digital investigations involve large amounts of data you must sort through to
find evidence; the Enron case, for example, involved terabytes of information. Unrelated
information (referred to as innocent information) is often included with the evidence you’re
trying to recover. It might be personal records of innocent people or confidential business
information, for example. When you find commingled evidence, judges often issue a limiting
phrase to the warrant, which allows the police to separate innocent information from
evidence. The warrant must list which items can be seized.
When approaching or investigating a crime scene, you might find evidence related to the
crime but not in the location the warrant specifies. You might also find evidence of another
unrelated crime. In these situations, this evidence is subject to the plain view doctrine. The
plain view doctrine states that objects falling in the direct sight of an officer who has the right
to be in a location are subject to seizure without a warrant and can be introduced into
evidence. For the plain view doctrine to apply, three criteria must be met:
•
The officer is where he or she has a legal right to be.
•
Ordinary senses must not be enhanced by advanced technology in any way, such as
with binoculars.
•
Any discovery must be by chance.
For the officer to seize the item, he or she must have probable cause to believe the item is evidence of a crime or is contraband. In addition, the police aren’t permitted to move objects to
get a better view. In Arizona v. Hicks (480 U.S. 321, 1987), the officer was found to have
acted unlawfully because he moved stereo equipment, without probable cause, to record the
serial numbers. The plain view doctrine has also been expanded to include the subdoctrines
of plain feel, plain smell, and plain hearing.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Preparing for a Search
149
In Horton v. California (496 U.S. 128, 1990), the court eliminated the requirement that the
discovery of evidence in plain view be inadvertent. Previously, “inadvertent discovery” was
required, which led to difficulties in defining this term. The three-prong Horton test requires
the following:
•
The officer must be lawfully present at the place where the evidence can be plainly viewed.
•
The officer must have a lawful right of access to the object.
•
The incriminating character of the object must be “immediately apparent.”
The plain view doctrine doesn’t extend to supporting a general exploratory search from one object to another unless something incriminating is found (Coolidge v. New Hampshire, 403 U.S. 443, 466, 1971).
However, the plain view doctrine’s applicability in the digital forensics world is being rejected.
The U.S. Court of Appeals for the Ninth Circuit has directly addressed this doctrine and used it
to give wide latitude to law enforcement (United States v. Wong, 334 F.3d 831, 9th Cir., 2003).
Other circuit courts have been less willing to address applying the doctrine to computer searches.
For example, police investigating a case have a search warrant authorizing the search of a computer for evidence related to illegal drug trafficking; during the search, the examiner observes an
.avi file, opens it, and sees that it’s child pornography. At that point, he must get an additional
warrant or an expansion of the existing warrant to continue the search for child pornography.
This approach is consistent with rulings in United States v. Carey (172 F.3d 1268, 10th Cir.,
1999) and United States v. Walser (275 F.3d 981, 10th Cir. 2001). In a more recent case that
went to the Ninth Circuit Court of Appeals, the original search warrant was for 10 major league
baseball players suspected of steroid use (United States v. Comprehensive Drug Testing, 2010).
During the examination of files and e-mails, 200 more players were implicated. Forensics investigators see many files when they’re searching for evidence, so in this case, their opinion was that
the data was in plain view. However, the court disagreed. As with the example of discovering
child pornography, a separate warrant for all other players should have been issued.
Preparing for a Search
Preparing for search and seizure of computers or digital devices is probably the most important step in digital investigations. The better you prepare, the smoother your investigation
will be. The following sections discuss the tasks you should perform before you search for
evidence. For these tasks, you might need to get answers from the victim (the complainant)
and an informant, who could be a police detective assigned to the case, a law enforcement
witness, or a manager or co-worker of the person of interest to the investigation.
Identifying the Nature of the Case
Recall from Chapter 1 that when you’re assigned a digital investigation case, you start by
identifying the nature of the case, including whether it involves the private or public sector.
For example, a corporate investigation might involve an employee abusing Internet privileges
by surfing the Web excessively or an employee who has filed an equal employment opportunity (EEO) or ethics complaint. Serious cases might involve an employee abusing company
digital assets to acquire or deliver contraband. Law enforcement cases could range from a
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
150
Chapter 4
check fraud ring to a homicide. The nature of the case dictates how you proceed and what
types of assets or resources you need to use in the investigation (discussed in more detail in
“Determining the Tools You Need” later in this chapter).
Identifying the Type of OS or Digital Device
Next, determine the type of OSs involved in the investigation. For law enforcement, this step
might be difficult because the crime scene isn’t controlled. You might not know what kinds
of digital devices were used to commit a crime or how or where they were used. In this case,
you must draw on your skills, creativity, and sources of knowledge, such as the Uniform
Crime Report discussed in Chapter 2, to deal with the unknown.
If you can identify the OS or device, estimate the size of the storage device on suspect computers and determine how many digital devices you have to process at the scene. Also, determine what hardware might be involved and whether the evidence is on a Microsoft, Linux,
Apple, or mainframe computer. For corporate investigators, configuration management databases (discussed in Chapter 2) make this step easier. Consultants to the private sector or law
enforcement officers might have to investigate more thoroughly to determine these details.
Determining Whether You Can Seize Computers and Digital Devices
Generally, the ideal situation for incident or crime scenes is seizing computers and digital
devices and taking them to your lab for further processing. However, the type of case and
location of the evidence determine whether you can remove digital equipment from the scene.
Law enforcement investigators need a warrant to remove computers from a crime scene and
transport them to a lab. If removing the computers will irreparably harm a business, the computers shouldn’t be taken offsite, unless you have disclosed the effect of the seizure to the
judge. An additional complication is files stored offsite that are accessed remotely. You must
decide whether the drives containing these files need to be examined. Another consideration
is the availability of cloud storage, which essentially can’t be located physically. The data is
stored on drives where data from many other subscribers might be stored.
If you aren’t allowed to take the computers and digital devices to your lab, determine the
resources you need to acquire digital evidence and which tools can speed data acquisition.
With large drives, such as a terabyte or more, acquisition times can increase to several hours.
In Chapter 3, you examined data acquisition software and learned which tools meet needs
for acquiring disk images. Some software, such as EnCase, compresses data while making
forensic images. For large drives, this compression might be necessary.
Getting a Detailed Description of the Location
The more information you have about the location of a digital crime, the more efficiently you
can gather evidence from the crime scene. Environmental and safety issues are the main
concerns during this process. Before arriving at an incident or crime scene, identify potential
hazards to your safety as well as that of other examiners.
Some cases involve dangerous settings, such as a drug bust of a methamphetamine lab
or a terrorist attack using biological, chemical, or nuclear contaminants. For these types of
investigations, you must rely on the skills of hazardous materials (HAZMAT) teams to
recover evidence from the scene. The recovery process might include decontaminating digital
components needed for the investigation, if possible. If the decontamination procedure might
destroy electronic evidence, a HAZMAT specialist or an investigator in HAZMAT gear
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Preparing for a Search
151
should make an image of a suspect’s drive. If you have to rely on a HAZMAT specialist to
acquire data, coach the specialist on how to connect cables and how to run the software.
You must be exact and articulate in your instructions.
Ambiguous or incorrect instructions could destroy evidence. Ideally, a digital forensics investigator trained in dealing with HAZMAT environments should acquire drive images. However, not all organizations have funds available for this training.
Whether you or a HAZMAT technician is the one acquiring an image, you should keep some
guidelines in mind. Before acquiring the data, a HAZMAT technician might suggest that
you put the target drive in a special HAZMAT bag, leaving the data and power cables out of
the bag but creating an airtight seal around the cables to prevent any contaminants from
entering the bag and affecting the target drive. When the data acquisition is finished, power
down the computer and then disconnect the data and power cables from the target drive. The
HAZMAT technician can then decontaminate the bag. When dealing with extreme conditions, such as biological or chemical hazardous contaminants, you might have to sacrifice
equipment, such as data and power cables, to perform a task. In certain instances, such as a
methamphetamine lab bust, the contaminants might be so toxic that hazards to the safety of
others prohibit acquiring any digital evidence.
In addition, if the temperature in the contaminated room is higher than 80 degrees, you should
take measures to avoid damage to the drive from overheating. In a dry desert region, consider
cooling the target drive by using sealed ice packs or double-wrapped bags of ice so that moisture
doesn’t leak out and damage the drive. In extreme conditions, consider the risks to evidence and
your equipment. You’ll need to brainstorm for solutions to overcome these problems. Moving
the equipment to a controlled environment is ideal; however, doing so isn’t always possible.
Determining Who Is in Charge
As discussed in Chapter 1, a company needs an established line of authority to specify who
can instigate or authorize an investigation. Corporate investigations usually require only one
person to respond to an incident or crime scene. Processing evidence usually involves acquiring an image of a suspect’s drive. In law enforcement, however, many investigations need
additional staff to collect all evidence quickly. For large-scale investigations, a crime or incident scene leader should be designated. Anyone assigned to a large-scale investigation scene
should cooperate with the designated leader to ensure that the team addresses all details when
collecting evidence.
Using Additional Technical Expertise
After you collect evidence data, determine whether you need specialized help to process the incident or crime scene. For example, suppose you’re assigned to process a crime scene at a data
center running Windows servers with several RAID drives and high-end Linux servers. If you’re
the lead on this investigation, you must identify the additional skills needed to process the crime
scene, such as enlisting help with a high-end server OS. Other concerns are how to acquire data
from RAID drives and how much data you can acquire. RAID servers typically process several
terabytes of data, and standard imaging tools might not be able to handle such large data sets.
When working at high-end computing facilities, identify the applications the suspect uses,
such as Oracle databases. You might need to recruit an Oracle specialist or site support staff
to help extract data for the investigation. Finding the right person can be an even bigger
challenge than conducting the investigation.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
152
Chapter 4
If you do need to recruit a specialist who’s not an investigator, develop a training program to
educate the specialist in investigative techniques. This advice also applies to specialists you
plan to supervise during search-and-seizure tasks. When dealing with digital evidence, an
untrained specialist can easily destroy evidence unintentionally, no matter how careful you
are in giving instructions and monitoring his or her activities.
Determining the Tools You Need
After you have gathered as much information as possible about the incident or crime scene,
you can start listing what you need at the scene. Being overprepared is better than being
underprepared, especially when you determine that you can’t transfer the computer to your
lab for processing.
To manage your tools, consider creating an initial-response field kit and an extensiveresponse field kit. Using the right kit makes processing an incident or crime scene much easier
and minimizes how much you have to carry from your vehicle to the scene.
Your initial-response field kit should be lightweight and easy to transport. With this kit, you
can arrive at a scene, acquire the data you need, and return to the lab as quickly as possible.
Figure 4-4 shows some items you might need, and Table 4-1 lists the tools you might need in
an initial-response field kit.
Figure 4-4 Items in an initial-response field kit
ª Cengage Learningâ
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Preparing for a Search
153
Table 4-1 Tools in an initial-response field kit
Number needed
Tools
1
Small computer toolkit
1
Large-capacity drive
1
IDE ribbon cable (ATA-33 or ATA-100)
1
SATA cables
1
Forensic boot media containing an acquisition utility
1
Laptop IDE 40- to 44-pin adapter, other adapter cables
1
Laptop or tablet computer
1
FireWire or USB dual write-protect external bay
1
Flashlight
1
Digital camera with extra batteries or 35mm camera with film and flash
10
Evidence log forms
1
Notebook or digital dictation recorder
10
Computer evidence bags (antistatic bags)
20
Evidence labels, tape, and tags
1
Permanent ink marker
10
External USB devices or a portable hard drive
4
ª 2016 Cengage Learningâ
An extensive-response field kit should include all the tools you can afford to take to the field.
When you arrive at the scene, you should extract only those items you need to acquire evidence. Doing so protects your equipment and minimizes how many items you have to keep
track of at the scene. Table 4-2 lists the tools you might need in an extensive-response field
kit, including external USB drives.
Table 4-2 Tools in an extensive-response field kit
Number needed
Tools
Varies
Assorted technical manuals, ranging from OS references to forensic analysis guides
1
Initial-response field kit
1
Laptop or tablet with cables and connectors
2
Electrical power strips
1
Additional hand tools, including bolt cutters, pry bar, and hacksaw
1
Leather gloves and disposable latex gloves (assorted sizes)
1
Hand truck and luggage cart
10
Large garbage bags and large cardboard boxes with packaging tape
1
Rubber bands of assorted sizes
1
Magnifying glass
1
Ream of printer paper
1
Small brush for cleaning dust from digital devices
(continues)
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
154
Chapter 4
Table 4-2 Tools in an extensive-response field kit (Continued )
Number needed
Tools
10
USB drives of varying sizes
2
External hard drives (1 TB or larger) with power cables
Assorted
Converter cables
5
Additional assorted hard drives or flash drives for data acquisition
ª 2016 Cengage Learningâ
When deciding what items to include in initial-response and extensive-response field kits, you
should also analyze needs specific to your region or organization. Refer to Tables 4-1 and 4-2
for guidelines.
Preparing the Investigation Team
Before you initiate the search and seizure of digital evidence at an incident or a crime scene,
you must review all the available facts, plans, and objectives with the investigation team you
have assembled. The goal of scene processing is to collect and secure digital evidence successfully. The better prepared you are, the fewer problems you encounter when you carry out the
plan to collect data.
Keep in mind that digital evidence is volatile. Develop the skills to assess the facts quickly,
make your plan, gather the needed resources, and collect data from the incident or crime
scene. In some digital investigations, responding slowly might result in the loss of important
evidence for the case.
Securing a Computer Incident or Crime Scene
Investigators secure an incident or crime scene to preserve the evidence and to keep information
about the incident or crime confidential. Information made public could jeopardize the investigation. If you’re in charge of securing a digital incident or crime scene, use barrier tape to prevent
bystanders from entering the scene accidentally, and ask police officers or security guards to prevent others from entering the scene or taking photos and videos with smartphones and other
digital devices. Legal authority for a corporate incident scene includes trespassing violations; for
a crime scene, it includes obstructing justice or failing to comply with a police officer. Access to
the scene should be restricted to only those people who have a specific reason to be there. The
reason for the standard practice of securing an incident or crime scene is to expand the area of
control beyond the scene’s immediate location. In this way, you avoid overlooking an area that
might be part of the scene. Shrinking the scene’s perimeter is easier than expanding it.
For major crime scenes, digital investigators aren’t usually responsible for defining a scene’s
security perimeter. These cases involve other specialists and detectives who are collecting
physical evidence and recording the scene. For incidents involving mostly computers, the
computers can be a crime scene within a crime scene or a secondary crime scene, containing
evidence to be processed. The evidence is in the computer, but the courts consider it physical
evidence. Computers and other digital devices can also contain actual physical evidence, such
as DNA evidence or fingerprints on keyboards. Crime labs can use special vacuums to extract
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Seizing Digital Evidence at the Scene
155
DNA residue from a keyboard to compare with other DNA samples. In a major crime scene,
law enforcement usually retains the keyboard and other peripherals.
Evidence is commonly lost or corrupted because of professional curiosity, which involves the
presence of police officers and other professionals who aren’t part of the crime scene–processing
team. They just have a compelling interest in seeing what happened, but their presence could
contaminate the scene directly or indirectly. Keep in mind that even those authorized and
trained to search crime scenes can alter the scene or evidence inadvertently.
For example, during one homicide investigation, the lead detective collected a good latent fingerprint from the crime scene. He compared it with the victim’s fingerprints and those of others
who knew the victim, but he couldn’t find a matching fingerprint. The detective suspected he
had the murderer’s fingerprint and kept it on file for several years until his police department
purchased an Automated Fingerprint Identification System (AFIS) computer. During acceptance
testing, the software vendor processed sample fingerprints to see how quickly and accurately
the system could match fingerprints in the database. The detective asked the testing team to run
the fingerprint he found at the homicide scene. He believed the suspect’s fingerprints were in
the AFIS database. The testing team complied and within minutes, AFIS found a near-perfect
match of the latent fingerprint: It belonged to the detective.
Always remember that professional curiosity can destroy or corrupt evidence, including digital evidence. When working at an incident or crime scene, be aware of what you’re doing and
what you have touched, physically or virtually. A police detective can take elimination prints
of everyone who had access to the crime scene to identify the fingerprints of known people;
digital evidence doesn’t have an equivalent elimination process. You must protect all digital
evidence, so make sure no one examines a suspect’s computer before you can capture and
preserve an image of the hard disk. For example, starting a computer without forensic boot
media alters important data, such as the date and timestamps of last access to certain files.
Seizing Digital Evidence at the Scene
With proper search warrants, law enforcement can seize all digital systems and peripherals.
In corporate investigations, you might have similar authority; however, you might have the
authority only to make an image of the suspect’s drive. Depending on company policies,
corporate investigators rarely have the authority to seize all computers and peripherals.
When seizing digital evidence in criminal investigations, follow the U.S. DOJ standards for
seizing digital data (described later in this chapter, or see www.justice.gov/criminal/cybercrime/
docs/ssmanual2009.pdf). Another good source for both criminal and civil procedures is ISO
standard 27037. For civil investigations, follow the same rules of evidence as for criminal investigation. You might be looking for specific evidence, such as a particular e-mail or spreadsheet.
In a criminal matter, investigators seize entire drives to preserve as much information as possible and make sure no evidence is overlooked. If you have any questions, doubts, or concerns,
consult with your attorney for additional guidance.
Preparing to Acquire Digital Evidence
The evidence you acquire at the scene depends on the nature of the case and the alleged crime
or violation. For a criminal case involving a drug dealer’s computer, for example, you need
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
156
Chapter 4
to take the entire computer along with any peripherals and media in the area, including
smartphones, USB devices, CDs/DVDs, printers, cameras, and scanners. Seizing peripherals
and other media ensures that you leave no necessary system components behind; often, predicting what components might be critical to the system’s operation is difficult. On the other
hand, if you’re investigating employee misconduct, you might need only a few specific items.
Before you collect digital evidence, ask your supervisor or senior forensics examiner in the
organization the following questions:
•
Do you need to take the entire computer and all peripherals and media in the immediate
area? How are you going to protect the computer and media while transporting them to
your lab?
•
Is the computer powered on when you arrive? (This question is discussed in more detail
later in “Processing an Incident or a Crime Scene.”)
•
Is the suspect you’re investigating in the immediate area of the computer? Is it possible
the suspect damaged or destroyed the computer, peripherals, or media? Will you have
to separate the suspect from the computer?
For example, suppose a company employee, Edward Braun, is suspected of using a company
computer at his desk to write a book. You suspect that Edward is saving personal files on the
computer’s hard drive. Using imaging software, you can copy the hard drive onto another
drive, install the duplicate hard drive in the computer, and take the original drive to your
forensics lab for examination. This procedure doesn’t create a bit-for-bit copy; you’re creating
a working copy for continued business operations and taking the original for examination.
Because Edward’s supervisors don’t want him to know he’s being investigated, you must create the working copy when he’s not at his desk and isn’t expected to return. Because most
people notice when something is out of order on their desks, you should photograph the
scene, measure the height of his chair, and record the position of items on his desk you need
to move before removing the hard drive. (The following section has more tips on photographing and documenting the scene.) After you create an image of his hard drive and substitute
the copy, return Edward’s belongings to their original locations.
Processing an Incident or a Crime Scene
The following guidelines offer suggestions on how to process an incident or crime scene. As
you gain experience in performing searches and seizures, you can add to or modify these
guidelines to meet the needs of specific cases. Use your judgment to determine what steps to
take when processing a civil or criminal investigation. For any difficult issues, seek out legal
counsel or other technical experts.
Keep a journal to document your activities. Include the date and time you arrive on the scene,
the people you encounter, and notes on every important task you perform. Update the journal
as you process the scene.
To secure the scene, use whatever is practical to make sure only authorized people can access
the area. Remove anyone who isn’t investigating the scene unless you need his or her help to
process the scene. For example, the company’s network administrator might need to help you
collect and recover data. As mentioned, you should secure a wider scene perimeter than necessary. Make sure nothing in this area, including digital evidence, moves until you have had
time to record it. Be professional and courteous to any curious onlookers, but don’t offer
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Seizing Digital Evidence at the Scene
157
information about the investigation or incident or answer questions. Refer journalists to a
public information officer or the organization’s public relations manager.
Take video and still recordings of the area around the computer or digital device. Start by
recording the overall scene, and then record details with close-up shots, including the back of
all computers. Before recording the back of each computer, place numbered or lettered labels
on each cable to help identify which cable is connected to which plug, in case you need to
reassemble components at the lab. Make sure you take close-ups of all cable connections,
including keyloggers (devices used to record keystrokes) and dongle devices used with software as part of the licensing agreement. Record the area around the computer, including the
floor and ceiling, and all access points to the computer, such as doors and windows. Be sure
to look under any tables or desks for anything taped to the underside of a table or desk
drawer or on the floor out of view. If the area has ceiling panels—false ceiling tiles—remove
them and record that area, too. Slowly pan or zoom the camera to prevent blurring in the
video image, and maintain a camera log for all shots you take.
When you finish videotaping or photographing the scene, sketch the incident or crime scene.
This sketch is usually a rough draft with notes on objects’ dimensions and distances between
fixed objects. For example, a note might read “The suspect’s computer is on the south wall,
three meters from the southeast corner of the room.” When you prepare your report, you can
make a clean, detailed drawing from your sketch, preferably using drawing software so that
the sketch is in electronic form.
Because digital data is volatile, check the state of each computer or device at the scene as soon
as possible. Determine whether the computer is powered on or off or in hibernation or sleep
mode. If it’s off, leave it off. If it’s on, use your professional judgment on what to do next.
Standard digital forensics practice has been to kill the computer’s power to make sure data
doesn’t become corrupt through covert means. Typically, this procedure is still acceptable on
legacy Windows and MS-DOS systems because turning off the power usually preserves data.
On Windows, UNIX, and Linux computers, generally you should do an orderly shutdown
first. Every shutdown process has inherent risks, however; to avoid data loss, you or your
supervisor might have to determine the best shutdown procedure.
In addition, there are many urban legends about criminals placing self-destruct mechanisms—
both hardware and software devices—in computers. Many years ago, a common trick was
altering the DOS program command.com by changing the dir (directory) command to the
deltree (delete the directory tree) command. When an investigator entered the dir command on a suspect’s computer, he would inadvertently start the deltree command, which
deletes all files and folders and their contents. More advanced criminals have been known to
create similar command-altering methods that overwrite a drive’s contents. In addition, computer owners who suspect someone will investigate their computers might set the computer to
delete the hard drive’s contents if the correct screensaver password isn’t entered.
As a general rule, don’t cut electrical power to a running system unless it’s an older Windows
or MS-DOS system. However, it’s a judgment call because of recent trends in digital crimes.
More digital investigations now revolve around network- and Internet-related cases, which
rely heavily on log file data. Certain files, such as the Event log and Security log in Windows,
might lose essential network activity records if power is terminated without a proper shutdown. Some government agencies, however, still teach investigators to “pull the plug”; it’s
the Digital Evidence First Responder’s (DEFR’s) judgment call.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
158
Chapter 4
If you’re working on a network or Internet investigation and the computer is on, save data in
any current applications as safely as possible and record all active windows or shell sessions.
Don’t examine folders or network connections or press any keys unless it’s necessary. For
systems that are powered on and running, photograph the screens. If windows are open but
minimized, expanding them so that you can photograph them is safe. As a precaution, write
down the contents of each window.
As you’re copying data on a live suspect computer, make notes in your journal about everything you do so that you can explain your actions in your formal report to prosecutors and
other attorneys. When you’ve finished recording screen contents, save them to external media.
For example, if one screen shows a Word file, save it to an external drive. Keep in mind that
the suspect might have changed the file since last using the Save command. If another screen is
a Web browser, take a screenshot or save the Web page to a USB drive or an external hard
drive. If the suspect computer has an active connection to a network server with enough storage, you can save large files to a folder on the server. To do so, you need the cooperation of the
network administrator to help direct you to the correct server and folder for storing the file.
If you can’t save an open application to external media, save the open application to the suspect drive with a new filename. Changing the filename avoids overwriting an existing file that
might not have been updated already. This method isn’t ideal and should be done only in
extreme emergency conditions. Remember that your goal is to preserve as much evidence in
as good a condition as is practical.
After you have saved all active files on the suspect computer, you can close all applications.
If an application prompts you to save before closing, don’t save the files. When all applications are closed, perform an orderly shutdown. If you’re not familiar with the correct shutdown method for the system you’re examining, consult someone who has expertise in this
procedure.
After you record the scene and shut down the system, bag and tag the evidence, following
these steps:
1. Assign one person, if possible, to collect and log all evidence. Minimize the number of
people handling evidence to ensure its integrity.
2. Tag all the evidence you collect with the current date and time, serial numbers or
unique features, make and model, and name of the person who collected it.
3. Maintain two separate logs of collected evidence to be reconciled for audit control
purposes and to verify everything you have collected.
4. Maintain constant control of the collected evidence and the crime or incident scene.
If the nature of the case doesn’t permit you to seize the computer or digital device, create
an image of the hard drive, as you learned in Chapter 3. Be sure to use critical investigative
methods and look for other physical drives, and verify that the image you created corresponds
to the device’s physical size.
In Chapter 10, you learn how to use forensics tools to acquire RAM.
Many studies are being conducted on how to analyze RAM systematically, in an effort to find relevant information in what seems to look
like random garbage data.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Seizing Digital Evidence at the Scene
159
During the data acquisition or immediately after collecting the evidence, look for information
related to the investigation, such as passwords, passphrases, personal identification numbers
(PINs), and bank account numbers (particularly offshore bank accounts, often used to hide
evidence of financial transactions). This information might be in plain view or out of sight in
a drawer or trashcan. At the scene, collect as much personal information as possible about
the suspect or victim. Collect all information related to facts about the crime or incident,
particularly anything that connects the suspect to the victim.
To finish your analysis and processing of a scene, collect all documentation and media related
to the investigation, including the following material:
•
Hardware, including peripheral devices
•
Software, including OSs and applications
•
All media, such as USB drives, backup tapes, and disks
•
All documentation, manuals, printouts, and handwritten notes
Processing Data Centers with RAID Systems
Digital investigators sometimes perform forensics analysis on RAID systems or server farms,
which are rooms filled with extremely large disk systems and are typical of large business
data centers, such as banks, insurance companies, and ISPs. As you learned in Chapter 3, one
technique for extracting evidence from large systems is called sparse acquisition. This technique extracts only data related to evidence for your case from allocated files and minimizes
how much data you need to analyze. A drawback of this technique is that it doesn’t recover
data in free or slack space. If you have a computer forensics tool that accesses unallocated
space on a RAID system, work with the tool on a test system first to make sure it doesn’t
corrupt the RAID system.
Using a Technical Advisor
When working with advanced technologies, recruit a technical advisor who can help you list
the tools you need to process the incident or crime scene. At large data centers, the technical
advisor is the person guiding you about where to locate data and helping you extract log
records or other evidence from large RAID servers. In law enforcement cases, the technical
advisor can help create the search warrant by itemizing what you need for the warrant. If
you use a technical advisor for this purpose, you should list his or her name in the warrant.
At the scene, a technical advisor can help direct other investigators to collect evidence
correctly. Technical advisors have the following responsibilities:
•
Know all aspects of the system being seized and searched.
•
Direct investigators on how to handle sensitive media and systems to prevent damage.
•
Help ensure security of the scene.
•
Help document the planning strategy for the search and seizure.
•
Conduct ad hoc training for investigators on the technologies and components being
seized and searched.
•
Document activities during the search and seizure.
•
Help conduct the search and seizure.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
160
Chapter 4
Documenting Evidence in the Lab
After you collect digital evidence at the scene, you transport it to a forensics lab, which
should be a controlled environment that ensures the security and integrity of digital evidence.
In any investigative work, be sure to record your activities and findings as you work. To do
so, you can maintain a journal to record the steps you take as you process evidence. Your
goal is to be able to reproduce the same results when you or another investigator repeat the
steps you took to collect evidence.
If you get different results when you repeat the steps, the credibility of your evidence becomes
questionable. At best, the evidence’s value is compromised; at worst, the evidence will be disqualified. Because of the nature of electronic components, failures do occur. For example,
you might not be able to repeat a data recovery because of a hardware failure, such as a disk
drive head crash. Be sure to report all facts and events as they occur.
Besides verifying your work, a journal serves as a reference that documents the methods you
used to process digital evidence. You and others can use it for training and guidance on other
investigations.
Processing and Handling Digital Evidence
You must maintain the integrity of digital evidence in the lab as you do when collecting it in the
field. Your first task is to preserve the disk data. If you have a suspect computer that hasn’t been
copied with an imaging tool, you must create a copy. When you do, be sure to make the suspect
drive read-only (typically by using a write-blocking device), and document this step. If the disk
has been copied with an imaging tool, you must preserve the image files. With most imaging
tools, you can create smaller, compressed volume sets to make archiving your data easier.
In Chapter 3, you learned how to use imaging tools, and in Chapter 1, you examined the
steps for preserving digital evidence with chain-of-custody controls. You use the following
steps to create image files:
1. Copy all image files to a large drive. Most forensics labs have several machines set up
with disk-imaging software and multiple hard drives that can be exchanged as needed
for your cases. You can use these resources to copy image files to large drives. Some
might be equipped with large network storage devices for ongoing cases.
2. Start your forensics tool to access and open the image files.
3. Run an MD5 or SHA-1 hashing algorithm on the image files to get a digital hash. Later
in “Obtaining a Digital Hash,” you learn how to compare MD5 or SHA-1 hashes to
make sure the evidence hasn’t changed.
4. When you finish copying image files to a larger drive, secure the original media in an
evidence locker. Don’t work with the original media; it should be stored in a locker
that has an evidence custody form. Be sure to fill out the form and date it.
Storing Digital Evidence
With digital evidence, you need to consider how and on what type of media to save it and
what type of storage device is recommended to secure it. The media you use to store digital
evidence usually depends on how long you need to keep it. If you investigate criminal
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Storing Digital Evidence
161
matters, store the evidence as long as you can. The ideal media on which to store digital data
are CDs, DVDs, DVD-Rs, DVD1Rs, or DVD-RWs. (CDs from the 1980s could last up to
5 years. The expected lifespan of CDs and DVDs is now 2 to 5 years.)
You can also use magnetic tape to preserve evidence data. The 4-mm DAT magnetic tapes
store between 40 to 72 GB or more of data, but like CD-Rs, they are slow at reading
and writing data. If you’re using these tapes, test stored data by copying the contents
from the tape back to a disk drive. Then verify that the data is good by examining it with forensics tools or doing an MD5 hash comparison of the original data and the newly restored
data.
If a 30-year lifespan for data storage is acceptable for your digital evidence, older DLT magnetic tape cartridge systems are a good choice. Keep in mind that you never know how long
it will take for a case to go to trial. DLT systems have been used with mainframe computers
for several decades and are reliable data-archiving systems. Depending on the size of the DLT
cartridge, one cartridge can store up to 80 GB of data in compressed mode. Speed of data
transfer from a hard drive to a DLT tape is also faster than transferring data to a CD-R or
DVD. The only major drawback of a DLT drive and tapes is cost. A drive can cost from
$400 to $800, and each tape is about $40. However, with the current large disk drives, the
DLT system does offer substantial labor savings over other systems.
Recently, manufacturers such as Quantum Corp. have introduced a high-speed, high-capacity
tape cartridge drive system called Super Digital Linear Tape (Super-DLT or SDLT). These
systems are specifically designed for large RAID data backups and can store more than 1 TB
of data. Smaller external SDLT drives can connect to a workstation through a SCSI card. In
addition, many external USB drives can hold 1 or more TB of information. Reliable offsite
storage and encrypted cloud storage are other options.
However, don’t rely on one media storage method to preserve your evidence—be sure to
make two copies of every image to prevent data loss. Also, if practical, use different tools to
create the two images because every tool has strengths and weaknesses. For example, you can
use the Linux dd command to create the first image and ProDiscover to create the second
image.
Evidence Retention and Media Storage Needs
To help maintain the chain of custody for digital evidence so that it’s accepted in court or by
arbitration, restrict access to your lab and evidence storage area. When your lab is open for
operations, authorized personnel must keep these areas under constant supervision. When
your lab is closed, at least two security workers should guard evidence storage cabinets and
lab facilities.
As a good security practice, your lab should have a sign-in roster for all visitors. Most
labs use a manual log system that an authorized technician maintains when an evidence
storage container is opened and closed. These logs should be maintained for a period based
on legal requirements, including the statute of limitations, the maximum sentence, and
expiration of appeal periods. Make the logs available for management to inspect. The evidence custody form should contain an entry for every person who handles the evidence (see
Figure 4-5).
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
162
Chapter 4
Figure 4-5 A sample log file
ª Cengage Learningâ
If you’re supporting a law enforcement agency, you might need to retain evidence indefinitely,
depending on the type of crime. Check with your local prosecuting attorney’s office or state
laws to make sure you’re in compliance. For the private sector or corporate environments,
check with your company’s legal department (the general counsel), which is responsible for
setting your organization’s standards for evidence retention. Cases involving child pornography are the exception: The evidence must be turned over to law enforcement. This material is
contraband and must not be stored by any person or organization other than a law enforcement agency.
Documenting Evidence
To document evidence, create or use an evidence custody form (shown in Chapter 1). Because
of constant changes in technologies and methods for acquiring data, create an electronic
evidence custody form that you can modify as needed. An evidence custody form serves the
following functions:
•
Identifies the evidence
•
Identifies who has handled the evidence
•
Lists dates and times the evidence was handled
After you have established these pieces of information, you can add others to your form, such
as a section listing MD5 and SHA-1 hash values. Include any detailed information you might
need to reference.
Evidence bags also include labels or evidence forms you can use to document your evidence.
Commercial companies offer a variety of sizes and styles of paper and plastic evidence bags.
Be sure to write on the bag when it’s empty, not when it contains digital evidence, to make
sure your writing is legible and to avoid damaging the evidence. You should use antistatic
bags for electronic components.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Obtaining a Digital Hash
163
Obtaining a Digital Hash
To verify data integrity, different methods of obtaining a unique identity for file data have
been developed. One of the first methods, the Cyclic Redundancy Check (CRC) is a mathematical algorithm that determines whether a file’s contents have changed. The most recent
version is CRC-32. CRC, however, is not considered a forensic hashing algorithm. The first
algorithm used for digital forensics was Message Digest 5 (MD5). Like CRC, MD5 is a mathematical formula that generates a hexadecimal code value, or hash value, based on the contents of a file, a folder, or an entire drive. If a bit or byte in the file changes, it alters the hash
value, a unique hexadecimal value that can be used to verify that a file or drive hasn’t
changed or been tampered with. Before you process or analyze a file, you can use a software
tool to calculate its hash value. After you process the file, you produce another digital hash. If
it’s the same as the original one, you can verify the integrity of your digital evidence with
mathematical proof that the file didn’t change.
According to work done by Wang Xiaoyun and her associates from Beijing’s Tsinghua University and Shandong University of Technology, there are three rules for forensic hashes:
•
You can’t predict the hash value of a file or device.
•
No two hash values can be the same. (Note that collisions have occurred in research
using supercomputers.)
•
If anything changes in the file or device, the hash value must change.
Another hashing algorithm is Secure Hash Algorithm version 1 (SHA-1), developed by the
National Institute of Standards and Technology (NIST). SHA-1 has slowly replaced MD5
and CRC-32, although MD5 is still widely used. (For more information on SHA-1, see
http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf.) In both MD5 and SHA-1, collisions have occurred, meaning two different files have the same hash value. Collisions are rare,
however, and despite flaws in MD5 and SHA-1, both are still used for validating digital
evidence collected from files and storage media. If a collision is suspected, you can do a byte-bybyte comparison to verify that all bytes are identical. Byte-by-byte comparisons can be done
with the MS-DOS comp command or the Linux/UNIX diff command. New developments in
this field happen constantly, however, so staying current by investigating the NIST Web site and
reading related journals is a good idea. New versions, such as SHA 256, are already being used.
Most digital forensics hashing needs can be satisfied with a nonkeyed hash set, which is a
unique hash number generated by a software tool, such as the Linux md5sum command. The
advantage of this type of hash is that it can identify known files, such as executable programs
or viruses, that hide themselves by changing their names. For example, many people who view
or transmit pornographic material change filenames and extensions to obscure the nature of
the contents. However, even if a file’s name and extension change, the hash value doesn’t.
The alternative to a nonkeyed hash is a keyed hash set, which is created by an encryption utility’s secret key. You can use the secret key to create a unique hash value for a file. Although a
keyed hash set can’t identify files as nonkeyed hash methods can, it can produce a unique
hash set for digital evidence.
You can use the MD5 function in FTK Imager to obtain the digital signature of a file or an
entire drive. In the following activity, you use a thumb drive, although you often work with
hard drives in actual investigations. First, you create a test file and then generate an MD5
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
164
Chapter 4
hash value for it. Then you change the file and produce another MD5 hash value, this time
noting the change in the hash value. You need a blank, formatted USB drive and a Windows
computer for the following steps:
1. Power on your forensic workstation, booting it to Windows.
2. Insert a blank, formatted USB drive into your computer.
3. Start Notepad. In a new text file, type This is a test to see how an MD5 digital hash
works.
4. Click File, Save As from the menu. In the File name text box, type InChap04.txt.
Navigate to your thumb drive, and then click Save.
5. Exit Notepad.
Next, you use FTK Imager Lite to determine the MD5 and SHA-1 hash values:
If you didn’t install FTK Imager Lite in Chapter 3, do so before
performing these steps.
1. Start FTK Imager Lite. In Windows 7 and 8, click Yes in the UAC message box, if
necessary.
2. Click File, Add Evidence Item from the menu. In the Select Source dialog box, click the
Logical Drive option button, and then click Next.
3. In the Select Drive dialog box, click the Source Drive Selection list arrow, click your
USB drive in the drop-down list, and then click Finish.
4. Right-click the USB drive at the upper left and click Verify Drive/Image. The verification
process takes a few minutes. When it finishes, you should see a window similar to
Figure 4-6. Copy the MD5 and SHA-1 hash values for this file to a text file in
Notepad, and then click Close. Click Save, and save the text file in your work folder
with a filename of your choosing. Close the Drive/Image Verify Results dialog box.
Figure 4-6 Using FTK Imager to verify hash values
ª 2014 AccessData Group, Inc. All Rights Reserved
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Reviewing a Case
165
5. In FTK Imager, click File, Remove Evidence Item from the menu. (You’re about to
make changes to the file and don’t want it open in FTK Imager while you do so.)
Leave FTK Imager running for the next set of steps.
Now you change the text file:
1. Start Notepad, and open the InChap04.txt file.
2. Delete one word from the sentence. Click File, Save, and save the file with the same
filename.
3. Repeat the previous activity’s steps in FTK Imager to generate MD5 and SHA-1 hash
values. Open the file containing the original hash values from Step 4 in the preceding
activity to compare the hash values. They should be different from the original hash
values you found for this file. When you’re finished, exit FTK Imager.
Reviewing a Case
Chapter 1 introduced tasks for planning your investigation, some of which are repeated in
the following list. Later in this section, you apply each task to a hypothetical investigation to
create a preparation plan for searching an incident or crime scene. The following are the
general tasks you perform in any digital forensics case:
•
Identify the case requirements.
•
Plan your investigation.
•
Conduct the investigation.
•
Complete the case report.
•
Critique the case.
The following sections give you an example of civil and criminal investigations, and then
you review how to perform some of these general tasks in a case involving a hypothetical
company.
Sample Civil Investigation
Most cases in the corporate environment are considered low-level investigations, or noncriminal cases. This doesn’t mean corporate digital investigations are less important; it means they
require less effort than a major criminal case. The example of a low-level civil investigation
in this section is an e-mail investigation that resulted in a lawsuit between two businesses.
An investigation of this nature requires examining only e-mail messages, not a complete disk
forensics analysis.
Mr. Jones at Company A claims to have received an order for $200,000 in widgets from the
purchasing manager, Mr. Smith, at Company B. Company A manufactures the widgets and
notifies Company B that they’re ready for shipment. Mr. Smith at Company B replies that
they didn’t order any widgets and won’t pay for them. Company A locates an e-mail requesting the widgets that appears to be from Mr. Smith and informs Company B about the e-mail.
Company B tells Company A that the e-mail didn’t originate from its e-mail server, and it
won’t pay for the widgets.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
166
Chapter 4
Company A files a lawsuit against Company B based on the widget order in Mr. Smith’s
e-mail. The lawyers for Company A contact the lawyers for Company B and discuss the lawsuit. Company A’s lawyers make discovery demands to conduct a digital forensics analysis
on Mr. Smith’s computer in hopes of finding the original message that caused the problem.
At the same time, Company B’s lawyers demand discovery on Mr. Jones’s computer because
they believe the e-mail is a fake.
As a digital investigator, you receive a call from your boss asking you to fulfill the discovery
demands from Company B’s lawyers to locate and determine whether the e-mail message on
Mr. Jones’s computer is real or fake. Because it’s an e-mail investigation, not a major crime
involving computers, you’re dispatched to Company A. When you get there, you find
Mr. Jones’s computer powered on and running Microsoft Outlook. The discovery order
authorizes you to recover only Mr. Jones’s Outlook e-mail folder, the .pst file. You aren’t
authorized to do anything else. You would take the following steps in this situation:
1. Close the Outlook program on Mr. Jones’s computer.
2. Use Windows Explorer to locate the Outlook .pst file containing his business
e-mail. You might need to use the Windows Search feature to find files with the
.pst extension.
3. Determine how large the .pst file is and connect the appropriate media device, such
as an external USB drive, to Mr. Jones’s computer.
4. Copy the .pst file to your external USB drive, and then remove the USB drive.
5. Fill out your evidence form, stating where on Mr. Jones’s disk you located the .pst
file, along with the date and time you performed this task.
6. Leave Company A and return to your computer forensics lab. Place the USB drive in
your evidence safe.
For most civil investigations, you collect only specific items that have been determined germane
by lawyers or the Human Resources Department.
Another activity common in the corporate environment is covert surveillance of employees
who are abusing their computing and network privileges. The use of covert surveillance of
employees must be well defined in company policy before it can be carried out. If a company
doesn’t have a policy that informs employees they have no privacy rights when using company computers and digital devices, no surveillance can be conducted without exposing the
company to civil or even criminal liability. If no policy exists, the company must create a policy and notify all employees about the new rules. Your legal department should create policy
language appropriate for your state or country and define the rights and authority the company has in conducting surveillance of employees according to provincial, state, or country
privacy laws.
For covert surveillance, you set up monitoring tools that record a suspect’s activity in real
time. Real-time surveillance requires sniffing data transmissions between a suspect’s computer
and a network server. Sniffing software, such as Wireshark, allows network administrators
and others to determine what data is being transmitted over the network. Other data-collecting tools (called keylogger programs—Spector and TrueActive Sofware, for example) are
screen capture programs that collect most or all screens and keystrokes on a suspect’s computer. Most of these tools run on Windows and usually collect data through remote network
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Reviewing a Case
167
connections. The tools are hidden or disguised as other programs in Windows Task Manager
and process logs.
Another covert surveillance product is Guidance Software EnCase Enterprise Edition (EEE),
which is a centrally located server with specialized software that can activate servlets over a
network to remote workstations. Digital investigators can perform forensics examinations in
real time through this remote connection to a suspect’s computer.
Sample Criminal Investigation
Crime scenes involving computers range from fraud cases to homicides. Because high-quality
printers are now available, one of the most common computer-related crimes is check fraud.
Many check fraud cases also involve making and selling false ID cards, such as driver’s licenses.
In one case, the police received a tip that a check-forging operation was active in an apartment building. After the detective contacted a reliable informant, he had enough information
for a search warrant and asked the patrol division to assist him in serving the warrant. When
the detective entered the suspect’s apartment and conducted a preliminary search, he found a
network of six high-end workstations with cables connected to devices in the adjacent apartment through a hole in the wall (see Figure 4-7). Unfortunately, the warrant specified a search
of only one apartment.
Figure 4-7 Search warrant limits
ª 2016 Cengage Learningâ
The detective contacted the deputy prosecutor, who instructed him to stand guard at
both apartments until she could have a judge issue an additional warrant for the neighboring
apartment. When he received the second search warrant, the detective entered the adjoining
apartment and continued his search, finding more computers, high-quality color laser
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
168
Chapter 4
printers, checks, and stolen blank driver’s licenses. The outcome of the investigation revealed
that the perpetrators were three enterprising high school students who were selling fake IDs
to fellow students. The check fraud scheme was a new sideline they were developing to
improve their cash flow.
Reviewing Background Information for a Case
Throughout this book, you’re using data files from the hypothetical M57 Patents case. These
files have been made available through a National Science Foundation (NSF) grant for digital
forensics students that makes full images of drives (with Microsoft proprietary information
redacted) available on bit-torrent sites for download. In this case, a new startup company,
M57 Patents, was in business for about a month, doing art patent searches. Later, a computer
sold on Craigslist was discovered to contain “kitty” porn. It was traced back to M57 Patents,
and an employee is suspected of downloading the porn.
For more details of the case, go to http://digitalcorpora.org/corpora/
scenarios/m57-patents-scenario, scroll down to the Exercise slides section, and read the PowerPoint slides.
Planning the Investigation
To determine what has happened, you need some background information on the case. The
main players are the CEO, Pat McGoo; the IT person, Terry; and the patent researchers, Jo
and Charlie. The police seized the digital evidence at the scene and made forensic copies of
the following evidence:
•
The image of the computer sold on Craigslist
•
The images of five other machines found at the M57 Patents office
•
The images of four USB drives found at M57 Patents
•
RAM from the imaged machines
•
Network data from the M57 Patents servers
Conducting the Investigation: Acquiring Evidence with
OSForensics
In the following activity, you use OSForensics to analyze an image file. In Chapters 1 and
3, you learned how to acquire an image of a drive with ProDiscover Basic and other tools.
To prepare OSForensics for analyzing the image of a suspect USB drive, follow these
steps:
1. If you haven’t downloaded the M57 files yet, start a Web browser and go to
http://digitalcorpora.org/corpora/scenarios/m57-patents-scenario. Scroll down,
click the USB Drive Images link, and download all four images to your work folder.
Next, create a subfolder of your work folder called InChap (so the path is
Work\Chap04\InChap).
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Reviewing a Case
169
2. Start OSForensics. If prompted to allow the program to make changes to your computer, click OK or Yes. In the OSForensics message box, click Continue Using Free
Version.
3. Click Start in the left pane, if necessary. In the right pane, click Create Case.
4. In the New Case dialog box, enter your name. For the case name, type M57 - USB
drives. Fill in the contact details and the organization, and then click Investigate
Disk(s) from Another Machine.
5. Click Custom Location for the case folder. Click the Browse button on the lower
right, navigate to and click your WorknChap04\InChap folder, and then click OK
twice. You should see the Manage Case window (see Figure 4-8).
Figure 4-8 The Manage Case window
Source: PassMark Software, www.osforensics.com
6. Click the Add Device button to open the Select device to add dialog box, and then
click the Image File option button. Click the browse button, navigate to your work
folder where you copied the USB drive images, click charlie-work-usb-200912-11.E01, and click Open.
7. In the message box asking which partition to use, leave the default setting use entire
image file, and then click OK. The completed “Select device to add” dialog box
should be similar to Figure 4-9. Click OK.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
170
Chapter 4
Figure 4-9 The “Select device to add” dialog box
Source: PassMark Software, www.osforensics.com
8. Click the charlie-work-usb-2009-12-11.E01 filename in the bottom pane
on the right, and then click the Open button to the left to open the File System
Browser window shown in Figure 4-10. Although viewing the files on a USB drive
in this window is fairly easy, tools to search for specific files are available. Close the
window.
9. Click the File Name Search button in the left pane of the main window.
Type charlie* in the Search String text box. Verify that the Start Folder
specifies Charlie’s USB image file. On the far right, click the Search button.
The results should be similar to Figure 4-11. You can use the tabs at the
top of the search results to see thumbnails of files and the timeline for
files on the device.
10. Next, click the Create Index button in the left pane to start the Create Index
Wizard. In the Step 1 of 5 window, click the Pre-determined File Types option
button, if necessary. Click all the file types listed (see Figure 4-12), and then
click Next.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Reviewing a Case
171
4
Figure 4-10 The File System Browser window
Source: PassMark Software, www.osforensics.com
Figure 4-11 The File Name Search window
Source: PassMark Software, www.osforensics.com
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
172
Chapter 4
Figure 4-12 Specifying the file types to index
Source: PassMark Software, www.osforensics.com
11. In the Step 2 of 5 window, click the Add button, click the charlie-work-usb2009-12-11.E01 file, click OK, and then click Next.
12. In the Step 3 of 5 window, type Index all file types in the Index Title text box, and
then click Start Indexing. The Step 4 of 5 window flashes by quickly, and then the
Step 5 of 5 window shows the files processing. When the indexing is finished, click
OK in the message box informing you that some errors might have occurred in the
indexing process.
13. Click the Open Log button at the lower right of the Step 5 of 5 window.
The window that opens shows you the files that were indexed, any errors that
occurred, and a summary of what was done. After examining the summary,
close the window.
14. Click the Manage Case button in the left pane. Notice that the index is now listed in
the bottom pane on the right. Scroll to the bottom of the left pane, and click the Exit
button.
This activity has given you a chance to see how indexing is done in the OSForensics tool you
use throughout the book. You should now be able to create a case, add it to your inventory,
scan the files, and perform indexing, which will be useful later for searching.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Chapter Summary
173
Chapter Summary
䊏
Digital evidence is anything stored or transmitted on electronic or optical media. It’s
extremely fragile and easily altered.
䊏
In the private sector, an incident scene is often a place of work, such as a contained
office or manufacturing area. Because everything from the computers used to violate a
company policy to the surrounding facility is under a controlled authority, investigating
and controlling the scene are easier than at a crime scene.
䊏
Companies should publish policies stating that they reserve the right to inspect digital
assets at will; otherwise, employees’ expectation of privacy prevents an employer from
legally conducting an intrusive investigation or covert surveillance. A well-defined
company policy states that an employer has the right to examine, inspect, or access any
company-owned digital asset.
䊏
Approved procedures must be followed, even in private-sector investigations, because
civil cases can easily become criminal cases. If an internal corporate case is turned over
to law enforcement because of criminal activity, the corporate investigator must avoid
becoming an agent of law enforcement.
䊏
Criminal cases require a correctly executed and well-defined search warrant. A specific
crime and location must be spelled out in the warrant. For all criminal investigations in
the United States, the Fourth Amendment specifies that a law enforcement officer can
search for and seize criminal evidence only with probable cause, which is facts or
circumstances that lead a reasonable person to believe a crime has been committed or
is about to be committed.
䊏
The plain view doctrine applies when investigators find evidentiary items that aren’t
specified in a warrant or under probable cause.
䊏
When preparing for a case, describe the nature of the case, identify the type of
OS, determine whether you can seize the computer or digital device, and obtain
a description of the location.
䊏
If you deal with situations involving hazardous materials often, you might need to
get HAZMAT certification or have someone else with this certification collect the
evidence.
䊏
Always take pictures or use a video camera to document the scene. Prevent professional
curiosity from contaminating evidence by limiting who enters the scene.
䊏
As you collect digital evidence, guard against physically destroying or contaminating it.
Take precautions to prevent static electricity discharge to electronic devices. If possible,
bag or box digital evidence and any hardware you collect from the scene. As you collect hardware, sketch the equipment, including exact markings of where components
are located. Tag and number each cable, port, and other connection and record its
number and description in a log.
䊏
Selecting a medium for storing digital evidence usually depends on how long you need
to keep the evidence. The ideal storage media are CDs, DVD-Rs, DVD-RWs, or offsite
storage. You can also use magnetic tape, such as 4-mm DAT and DLT magnetic tapes.
䊏
Forensic hash values are used to verify that data or storage media haven’t been altered.
The two most common hashing algorithms for forensics purposes are currently MD5
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
174
Chapter 4
and SHA-1. A forensic hash can’t be predicted, each file produces a unique hash value,
and if the file changes, the hash value must change.
䊏
To analyze digital forensics data, learn to use more than one vendor tool. Vendors offer
different methods for recovering data from digital media.
䊏
You must handle all evidence the same way every time you handle it. Apply the same
security and accountability controls for evidence in a civil lawsuit as for evidence from
a crime scene to comply with state or federal rules of evidence.
䊏
After you determine that an incident scene has digital data or devices, identify the
information or artifacts that can be used as evidence. Next, catalog or document
the evidence you find. Your goal is to preserve evidence integrity, which means
you must not modify the evidence as you collect and catalog it. An incident scene
should be photographed and sketched, and then each item labeled and put in an
evidence bag. Collect, preserve, document, analyze, identify, and organize the
evidence. Then rebuild evidence or repeat a situation to verify that you get the same
results every time.
Key Terms
Automated Fingerprint Identification System (AFIS) A computerized system for identifying
fingerprints that’s connected to a central database; used to identify criminal suspects and
review thousands of fingerprint samples at high speed.
computer-generated records Data generated by a computer, such as system log files or
proxy server logs.
computer-stored records Digital files generated by a person, such as electronic spreadsheets.
covert surveillance Observing people or places without being detected, often using electronic
equipment, such as video cameras or key stroke/screen capture programs.
Cyclic Redundancy Check (CRC) A mathematical algorithm that translates a file into a unique
hexadecimal value.
digital evidence Evidence consisting of information stored or transmitted in electronic form.
extensive-response field kit A portable kit designed to process several computers and a
variety of operating systems at a crime or incident scene involving computers. This kit should
contain two or more types of software or hardware computer forensics tools, such as extra
storage drives.
hash value A unique hexadecimal value that identifies a file or drive.
hazardous materials (HAZMAT) Chemical, biological, or radiological substances that can
cause harm to people.
initial-response field kit A portable kit containing only the minimum tools needed to
perform disk acquisitions and preliminary forensics analysis in the field.
innocent information Data that doesn’t contribute to evidence of a crime or violation.
keyed hash set A value created by an encryption utility’s secret key.
limiting phrase Wording in a search warrant that limits the scope of a search for evidence.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Review Questions
175
low-level investigations Corporate cases that require less investigative effort than a major
criminal case.
Message Digest 5 (MD5) An algorithm that produces a hexadecimal value of a file or storage
media. Used to determine whether data has been changed.
National Institute of Standards and Technology (NIST) One of the governing bodies
responsible for setting standards for some U.S. industries.
nonkeyed hash set A unique hash number generated by a software tool and used to identify
files.
person of interest Someone who might be a suspect or someone with additional
knowledge that can provide enough evidence of probable cause for a search warrant
or arrest.
plain view doctrine When conducting a search and seizure, objects in plain view of a law
enforcement officer, who has the right to be in position to have that view, are subject to
seizure without a warrant and can be introduced as evidence. As applied to executing
searches of computers, the plain view doctrine’s limitations are less clear.
probable cause The standard specifying whether a police officer has the right to make an
arrest, conduct a personal or property search, or obtain a warrant for arrest.
professional curiosity The motivation for law enforcement and other professional personnel
to examine an incident or crime scene to see what happened.
Scientific Working Group on Digital Evidence (SWGDE) A group that sets standards for
recovering, preserving, and examining digital evidence.
Secure Hash Algorithm version 1 (SHA-1) A forensic hashing algorithm created by NIST to
determine whether data in a file or on storage media has been altered.
sniffing Detecting data transmissions to and from a suspect’s computer and a network server
to determine the type of data being transmitted over a network.
Review Questions
1. Corporate investigations are typically easier than law enforcement investigations for
which of the following reasons?
a. Most companies keep inventory databases of all hardware and software used.
b.
The investigator doesn’t have to get a warrant.
c.
The investigator has to get a warrant.
d.
Users can load whatever they want on their machines.
2. In the United States, if a company publishes a policy stating that it reserves the right to
inspect computing assets at will, a corporate investigator can conduct covert surveillance
on an employee with little cause. True or False?
3. If you discover a criminal act, such as murder or child pornography, while investigating
a corporate policy abuse, the case becomes a criminal investigation and should be
referred to law enforcement. True or False?
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
176
Chapter 4
4. As a corporate investigator, you can become an agent of law enforcement when which of
the following happens? (Choose all that apply.)
a. You begin to take orders from a police detective without a warrant or subpoena.
b.
Your internal investigation has concluded, and you have filed a criminal complaint
and turned over the evidence to law enforcement.
c.
Your internal investigation begins.
d.
None of the above.
5. The plain view doctrine in computer searches is well-established law. True or False?
6. If a suspect computer is found in an area that might have toxic chemicals, you must do
which of the following? (Choose all that apply.)
a. Coordinate with the HAZMAT team.
b.
Determine a way to obtain the suspect computer.
c.
Assume the suspect computer is contaminated.
d.
Do not enter alone.
7. What are the three rules for a forensic hash?
8. In forensic hashes, a collision occurs when _______________________.
9. List three items that should be in an initial-response field kit.
10. When you arrive at the scene, why should you extract only those items you need to
acquire evidence?
11. Computer peripherals or attachments can contain DNA evidence. True or False?
12. If a suspect computer is running Windows 7, which of the following can you perform
safely?
a. Browsing open applications
b.
Disconnecting power
c.
Either of the above
d.
None of the above
13. Describe what should be videotaped or sketched at a digital crime scene.
14. Which of the following techniques might be used in covert surveillance? (Choose all that
apply.)
a. Keylogging
b.
Data sniffing
c.
Network logs
15. Commingling evidence means what in a corporate setting?
16. List two hashing algorithms commonly used for forensic purposes.
17. Small companies rarely need investigators. True or False?
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
177
18. If a company doesn’t distribute a computing use policy stating an employer’s right to
inspect employees’ computers freely, including e-mail and Web use, employees have an
expectation of privacy. True or False?
19. You have been called to the scene of a fatal car crash where a laptop computer is still
running. What type of field kit should you take with you?
20. You should always answer questions from onlookers at a crime scene. True or False?
Hands-On Projects
Create a WorknChap04nProjects folder on your system before starting these projects. If you
haven’t downloaded the drive images for the M57 Patents case, go to http://digitalcorpora.
org/corpora/scenarios/m57-patents-scenario and do so now. In addition, download all files
under the heading “Detective reports, warrant and affidavit.”
Hands-On Project 4-1
Read the four detective reports and the combined affidavit and warrant. Write
a one- to two-page paper describing the evidence the police found and explaining whether they had enough information for the search warrant. Did the
information justify taking all the computers and USB drives? Why or why not?
Hands-On Project 4-2
You’re investigating an internal policy violation when you find an e-mail about
a serious assault for which a police report needs to be filed. What should you
do? Write a two-page paper specifying who in your company you need to talk
to first and what evidence must be turned over to the police.
Hands-On Project 4-3
This chapter introduced the M57 Patents case, which is a hypothetical case created for new investigators to practice on real data. In this project, you examine
the USB drive of Terry, the IT person. Your job is to ascertain whether Terry is
involved in anything illicit or against company policy.
1. Start OSForensics. If prompted to allow the program to make changes to
your computer, click OK or Yes. In the OSForensics message box, click
Continue Using Free Version.
2. Click Start in the left pane, if necessary. In the right pane, click Create Case.
3. In the New Case dialog box, enter your name in the Investigator text box.
In the Case Name text box, type M57 - Terrys USB drive. Fill in the contact details and the organization, and then click Investigate Disk(s) from
Another Machine.
4. Click Custom Location for the case folder. Click the Browse button on the
lower right, navigate to and click your WorknChap04nProjects folder, and
then click OK twice. You should see the Manage Case window.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
178
Chapter 4
5. Click the Add Device button to open the “Select device to add” dialog
box, and then click the Image File option button. Click the browse
button, navigate to the folder you copied images to, and click
terry-work-usb-2009-12-11.E01. Click Open.
6. In the message box asking which partition to use, leave the default setting
use entire image file, and then click OK. Click OK to close the “Select
device to add” dialog box.
7. Click the terry-work-usb-2009-12-11.E01 filename at the lower
right, and then click the Open button to the left to open the File System
Browser window.
8. Click the File Name Search icon in the File System Browser window or the
left pane of the main window. In the Search String text box, type kitty*.
On the far right, click the Search button. Notice that the “kitty porn” isn’t
on his USB drive.
9. Click the Create Index button in the left pane. (Note: You might have to
click New Index if the window is showing the results from the index of
Charlie’s USB drive.) In the Step 1 of 5 window, click the Pre-determined
File Types option button, click all the file types listed, and then click Next.
10. In the Step 2 of 5 window, click Charlie’s USB image and click Remove to
delete it from the list box, if necessary. Click Add, click terry-workusb-2009-12-11.E01, click OK, and then click Next.
11. In the Step 3 of 5 window, type Index all file types in the Index Title text
box, and then click Start Indexing. When the indexing is finished, which
might take up to an hour, click OK in the message box.
12. Click the Open Log button at the lower right, and examine the log. Notice
whether any errors were reported and the number of files processed, and
then close the log.
13. Click the Manage Case button in the left pane. In the lower right pane,
double-click Terrys USB under the Devices heading, open any text or
picture files, and examine them.
14. Scroll to the bottom of the left pane, and click the Exit button. Write
a one- to two-page paper explaining the importance of the files you
examined. How might they affect a patent case?
Hands-On Project 4-4
In this project, you create a file on a USB drive and calculate its hash value in
FTK Imager. Then you change the file and calculate the hash value again to
compare the files. You need a Windows computer and a USB drive.
1. Create a folder called C4Prj04 on your USB drive, and then start Notepad.
2. In a new text file, type This is a test of hash values. One definition of a
forensic hash is that if the file changes, the hash value changes.
3. Save the file as hash1.txt in the C4Prj04 folder on your USB drive, and
then exit Notepad.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
179
4. Start FTK Imager (clicking OK or Yes in the UAC message box, if necessary), and click File, Add Evidence Item from the menu. In the Select
Source dialog box, click the Logical Drive option button, and then click
Next.
5. In the Select Drive dialog box, click the Source Drive Selection list arrow,
click to select your USB drive, and then click Finish.
6. In the upper-left pane, click to expand your USB drive and continue
expanding until you can click the C4Prj04 folder. In the upper-right pane,
you should see the hash1.txt file you created.
7. Right-click the file and click Export File Hash List. Save the file as original
hash in the C4Prj04 folder on your USB drive. FTK Imager saves it as a
.csv file. Exit FTK Imager, and start Notepad.
8. Open hash1.txt in Notepad. Add one letter to the end of the file, save it,
and exit Notepad.
9. Start FTK Imager again. Repeat Steps 4 to 7 (but without starting
Notepad), but this time when you export the file hash list, save the file
as changed hash.
10. Open the original hash and changed hash files on your USB drive in
Excel (or another spreadsheet program). Compare the hash values in both
files to see whether they are different, and then exit Excel.
Hands-On Project 4-5
In this project, you create a file on your USB drive and calculate its hash values
in FTK Imager. Then you change the filename and extension and calculate the
hash values again to compare them. You need a Windows computer and a
USB drive.
1. Create a folder called C4Prj05 on your USB drive, and then start Notepad.
2. In a new text file, type This project shows that the file, not the filename,
has to change for the hash value to change.
3. Click File, Save As from the menu, and save the file as testhash.txt in
the C4Prj05 folder on your USB drive. Exit Notepad, and start FTK
Imager (clicking OK or Yes in the UAC message box, if necessary).
4. Click File, Add Evidence Item from the menu. In the Select Source dialog
box, click the Logical Drive option button, and then click Next.
5. In the Select Drive dialog box, click the Source Drive Selection list arrow,
click to select your USB drive, and then click Finish.
6. In the upper-left pane, click to expand your USB drive and continue
expanding until you can click the C4Prj05 folder. In the upper-right pane,
you should see the testhash.txt file you created.
7. Right-click the file and click Export File Hash List. Save the file as
original hash value in the C4Prj05 folder on your USB drive.
FTK Imager saves it as a .csv file.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
180
Chapter 4
8. Click to select your USB drive in the upper-left pane, if necessary, and then
click File, Remove Evidence Item from the menu. Exit FTK Imager.
9. Open Windows Explorer. Right-click the testhash.txt file on your
USB drive, and rename it as testhash.doc. In the warning message
about the change in extension, click Yes.
10. Start FTK Imager. Follow Steps 4 to 7, but this time when you export the
file hash list, save the file as changed hash value. Exit FTK Imager.
11. Open original hash value and changed hash value in Excel (or
another spreadsheet program). Compare the hash values in both files to see
whether they are different, and then exit Excel.
Case Projects
Case Project 4-1
You’re a detective for the local police. Thomas Brown, the primary suspect
in a murder investigation, works at a large local firm and is reported to
have two computers at work in addition to one at home. What do you need
to do to gather evidence from these computers, and what obstacles can you
expect to encounter during this process? Write a two- to three-page report
stating what you would do if the company had its own Computer Forensics
and Investigations Department and what you would do if the company
did not.
Case Project 4-2
A murder in a downtown office building has been widely publicized. You’re a
police detective and receive a phone call from a digital forensics investigator
employed by the police department. His name is Gary Owens, and he says he
has information that might relate to the murder case. Gary says he ran across a
few files while investigating another case at a company in the same office building. Considering the plain view doctrine, what procedures might you and he,
as public officials, have to follow? Write a one-page paper detailing what you
might do.
Case Project 4-3
Your spouse works at a middle school and reports rumors of a teacher,
Zane Wilkens, molesting some students and taking illicit pictures of them.
Zane allegedly viewed these pictures in his office. Your spouse wants you to
take a disk image of Zane’s computer and find out whether the rumors are
true. Write a one- to two-page paper outlining how you would tell your
spouse and school administrators to proceed. Also, explain why walking
into Zane’s office to acquire a disk image wouldn’t preserve the integrity of
the evidence.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Case Projects
181
Case Project 4-4
As a digital investigator for your local sheriff’s department, you have been
asked to go with a detective to a local school that received a bomb threat in an
anonymous e-mail. The detective already has information from a subpoena
sent to the last known ISP where the anonymous e-mail originated, and the
message was sent from a residence in the school’s neighborhood. The detective
tells you the school principal also stated that the school’s Web server had been
defaced by an unknown computer attacker. The detective has just obtained a
warrant for the search and seizure of a computer at the residence the ISP identified. Prepare a list of what items should be included in an initial-response field
kit to ensure the preservation of digital evidence when the warrant is carried out.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
4
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
chapter
5
Working with
Windows and
CLI Systems
After reading this chapter and completing
the exercises, you will be able to:
• Explain the purpose and structure of file systems
• Describe Microsoft file structures
• Explain the structure of NTFS disks
• List some options for decrypting drives encrypted
with whole disk encryption
• Explain how the Windows Registry works
• Describe Microsoft startup tasks
• Explain the purpose of a virtual machine
183
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
184
Chapter 5
This chapter and Chapter 7 give you an overview of digital data and drives. In this
chapter, you review how data is stored and managed in Microsoft OSs, including Windows
and command-line interface (CLI) OSs. To become proficient in recovering data for digital
investigations, you should understand file systems and their OSs, including legacy (MS-DOS,
Windows 9x, and Windows Me, for example) and current OSs. In this chapter, you examine
the tasks an OS performs when it starts so that you can avoid altering evidence when you
examine data on a drive. You also learn how to use a Virtual PC environment to further analyze Windows digital evidence. Chapter 7 discusses Linux and Macintosh file systems and covers hardware devices, such as CDs/DVDs, CD/DVD-RWs, and SCSI, IDE, and SATA drives.
Understanding File Systems
To investigate digital evidence effectively, you must understand how the most commonly used
OSs work and how they store files. In addition to this section on file systems, you should
review books on Computer Technology Industry Association (CompTIA) A1 certifications
in hardware and firmware startup tasks and operations.
A file system gives an OS a road map to data on a disk. The type of file system an OS uses
determines how data is stored on the disk. When you need to access a suspect’s computer to
acquire or inspect data related to your investigation, you should be familiar with both the
computer’s OS and file system so that you can access and modify system settings when necessary. This chapter examines Windows and CLI OSs in detail; Chapter 7 covers information
on Linux and Macintosh. For other OSs, consult system administrators and vendor manuals.
Understanding the Boot Sequence
This section explains the boot sequence for desktop and laptop computers. For tablets and
smartphones, it’s best to review vendors’ documentation. To ensure that you don’t contaminate or alter data on a suspect’s system, you must know how to access and modify Complementary Metal Oxide Semiconductor (CMOS), BIOS, Extensible Firmware Interface (EFI),
and Unified Extensible Firmware Interface (UEFI) settings. A computer stores system configuration and date and time information in the CMOS when power to the system is off. The system BIOS or EFI contains programs that perform input and output at the hardware level.
BIOS is designed for x86 computers and typically used on disk drives with Master Boot
Records (MBR). EFI is designed for x64 computers and uses GUID Partition Table (GPT)formatted disks. BIOS and EFI are designed for specific firmware. In an effort to reduce the
relationship with firmware, Intel developed UEFI, which defines the interface between a computer’s firmware and the OS. (For more information on Windows boot processes, see Windows 8 Administration, by William R. Stanek, Microsoft Press 2012.)
The following paragraph describes how a BIOS boot works. For
more information on the differences in these boot utilities, see
www.cs.rutgers.edu/pxk/416/notes/02-boot.html.
When a subject’s computer starts, you must make sure it boots to a forensically configured CD,
DVD, or flash drive, as described in Chapters 1 and 3, because booting to the hard disk overwrites and changes evidentiary data. To do this, you access the CMOS setup by monitoring the
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding File Systems
185
computer during the bootstrap process to identify the correct key or keys to use. The bootstrap
process, which is contained in ROM, tells the computer how to proceed. As the computer
starts, the screen usually displays the key or keys, such as the Delete key, you press to open the
CMOS setup screen. You can also try unhooking the keyboard to force the system to tell you
what keys to use. The key you press to access CMOS depends on the computer’s BIOS. Many
BIOS manufacturers use the Delete key to access CMOS; other manufacturers use
Ctrl1Alt1Insert, Ctrl1A, Ctrl1S, or Ctrl1Fl, F2, or F10. A safe method for verifying the
BIOS is removing all hard drives from the computer, which enables you to start the computer
to verify its BIOS date and time without accessing the disk drive.
Figure 5-1 shows a typical CMOS setup screen, where you check a computer’s boot sequence.
If necessary, you can change the boot sequence so that the OS accesses the CD/DVD drive,
for example, before any other boot device. Each BIOS vendor’s screen is different, but you
can refer to the vendor’s documentation or Web site for instructions on changing the boot
sequence.
Figure 5-1 A typical CMOS setup screen
Courtesy of Phoenix Technologies, Ltd.
Understanding Disk Drives
You should be familiar with disk drives and how data is organized on a disk so that you can
find data effectively. Disk drives are made up of one or more platters coated with magnetic
material, and data is stored on platters in a particular way. Following is a list of disk drive
components, illustrated in Figure 5-2:
•
Geometry—Geometry refers to a disk’s logical structure of platters, tracks, and
sectors.
•
Head—The head is the device that reads and writes data to a drive. There are two
heads per platter that read and write the top and bottom sides.
•
Tracks—Tracks are concentric circles on a disk platter where data is located.
•
Cylinders—A cylinder is a column of tracks on two or more disk platters. Typically,
each platter has two surfaces: top and bottom.
•
Sectors—A sector is a section on a track, usually made up of 512 bytes.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
186
Chapter 5
Figure 5-2 Components of a disk drive
ª Cengage Learningâ
For more information on disk drive configurations, see
www.storagereview.com/guide2000/ref/hdd/index.html.
The manufacturer engineers a disk to have a certain number of sectors per track, and a typical
disk drive stores 512 bytes per sector. (For Advanced Format disks, 4096 bytes per sector are
stored; see http://msdn.microsoft.com/en-us/library/windows/desktop/hh848035%28v¼vs.
85%29.aspx.) To determine the total number of addressable bytes on a disk, multiply the number
of cylinders by the number of heads (actually tracks) and by the number of sectors (groups of 512
or more bytes), as shown in Figure 5-3. Disk drive vendors refer to this formula as a cylinder,
head, and sector (CHS) calculation. Tracks also follow a numbering scheme starting from 0, which
is the first value in computing. If a disk lists 79 tracks, you actually have 80 tracks from 0 to 79.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding File Systems
187
5
Figure 5-3 CHS calculation
ª Cengage Learningâ
Other disk properties, such as zone bit recording (ZBR), track density, areal density, and
head and cylinder skew, are handled at the drive’s hardware or firmware level. ZBR is how
most manufacturers deal with a platter’s inner tracks having a smaller circumference (and,
therefore, less space to store data) than its outer tracks. Grouping tracks by zones ensures
that all tracks hold the same amount of data.
Track density is the space between each track. As with old vinyl records, the smaller the space
between each track, the more tracks you can place on the platter.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
188
Chapter 5
Areal density refers to the number of bits in one square inch of a disk platter. This number
includes the unused space between tracks. Head and cylinder skew are used to improve disk
performance. As the read-write head moves from one track to another, starting sectors are
offset to minimize lag time.
Solid-State Storage Devices
Flash memory storage devices used in USB drives, laptops, tablets, and cell phones can be a
challenge for digital forensics examiners because if deleted data isn’t recovered immediately,
it might be lost forever. The reason is a feature all flash memory devices have: wear-leveling.
When data is deleted on a hard drive, only the references to it are removed, which leaves the
original data in unallocated disk space. With forensics recovery tools, recovering data from
magnetic media is fairly easy by copying the unallocated space. USB drives are different, in
that memory cells shift data at the physical level to other cells that have had fewer reads and
writes continuously. The purpose of shifting (or rotating) data from one memory cell to
another is to make sure all memory cells on the flash drive wear evenly. Memory cells are
designed to perform only 10,000 to 100,000 reads/writes, depending on the manufacturer’s
design. When they reach their defined limits, they can no longer retain data. When you
attempt to connect to the device, you get an access failure message. This process is controlled
on the flash device’s firmware.
In addition, when data is rotated to another memory cell, the old memory cell addresses are
listed in a firmware file called a “garbage collector.” At some point, the flash drive’s firmware
erases data in unallocated cells by overwriting the value of 1 in all cells listed in the garbage
collector file.
When dealing with solid-state devices, making a full forensic copy as soon as possible is crucial in case you need to recover data from unallocated disk space. You can test this feature
with a USB drive easily by copying data to it, deleting it, and then making a forensic acquisition with any acquisition tool, such as ProDiscover or X-Ways Forensics, immediately after
the data is deleted. The first acquisition produces recoverable artifacts. If you let the USB
drive sit and write no additional data to it, wear-leveling automatically overwrites the unallocated space. All solid-state drives have an internal power source for memory cells (both allocated and unallocated) so that they can preserve data. If you make another acquisition of the
USB drive a day or more later, it reveals that the previously recoverable deleted data no longer exists. For mobile device forensics, this feature is extremely important, especially if a suspect deleted relevant messages, for example, just before the device was seized and taken into
evidence.
Depending on your jurisdiction and country’s laws on search and seizure, there might be some
limitations on when an acquisition can take place in criminal cases. For criminal investigations,
you should get guidance from your local prosecutor’s office on how to handle this type of evidence.
Exploring Microsoft File Structures
Because most PCs use Microsoft software products, you should understand Microsoft file
systems so that you know how Windows and DOS computers store files. In particular, you
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Exploring Microsoft File Structures
189
need to understand clusters, File Allocation Table (FAT), and NT File System (NTFS). The
method an OS uses to store files determines where data can be hidden. When you examine a
computer for forensic evidence, you need to explore these hiding places to determine
whether they contain files or parts of files that might be evidence of a crime or policy
violation.
In Microsoft file structures, sectors are grouped to form clusters, which are storage allocation
units of one or more sectors. Clusters range from 512 bytes up to 32,000 bytes each. Combining sectors minimizes the overhead of writing or reading files to a disk. The OS groups
one or more sectors into a cluster. The number of sectors in a cluster varies according to the
disk size. For example, a double-sided floppy disk has one sector per cluster; a hard disk has
four or more sectors per cluster.
Clusters are numbered sequentially, starting at 0 in NTFS and 2 in FAT. The first sector of all
disks contains a system area, the boot record, and a file structure database. The OS assigns
these cluster numbers, which are referred to as logical addresses. These addresses point to relative cluster positions; for example, cluster address 100 is 98 clusters from cluster address 2.
Sector numbers, however, are referred to as physical addresses because they reside at the
hardware or firmware level and go from address 0 (the first sector on the disk) to the last sector on the disk. Clusters and their addresses are specific to a logical disk drive, which is a disk
partition.
Disk Partitions
Many hard disks are partitioned, or divided, into two or more sections. A partition is a
logical drive. Windows OSs can have three primary partitions followed by an extended
partition that can contain one or more logical drives. Someone who wants to hide data
on a hard disk can create hidden partitions or voids—large unused gaps between partitions on a disk drive. For example, partitions containing unused space can be created
between the primary partitions or logical partitions. This unused space between partitions
is called the partition gap. It’s possible to create a partition, add data to it, and then
remove references to the partition so that it can be hidden in Windows. If data is hidden
in this partition gap, a disk editor utility could be used to access it. Another technique is
to hide incriminating digital evidence at the end of a disk by declaring a smaller number
of bytes than the actual drive size. With disk-editing tools, however, you can access these
hidden or empty areas of the disk.
One way to examine a partition’s physical level is to use a disk editor, such as WinHex or
Hex Workshop. These tools enable you to view file headers and other critical parts of a file.
Both tasks involve analyzing the key hexadecimal codes the OS uses to identify and maintain
the file system. Table 5-1 lists the hexadecimal codes in a partition table and identifies some
common file system structures.
To understand hexadecimal numbering better, see www.i-programmer.
info/babbages-bag/478-hexadecimal.html.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
190
Chapter 5
Table 5-1 Hexadecimal codes in the partition table
Hexadecimal code
File system
01
DOS 12-bit FAT (floppy disks)
04
DOS 16-bit FAT for partitions smaller than 32 MB
05
Extended partition
06
DOS 16-bit FAT for partitions larger than 32 MB
07
NTFS and exFAT
08
AIX bootable partition
09
AIX data partition
0B
DOS 32-bit FAT
0C
DOS 32-bit FAT for interrupt 13 support
0F
Extended Partition with Logical Block Address (LBA)
17
Hidden NTFS partition (XP and earlier)
1B
Hidden FAT32 partition
1E
Hidden VFAT partition
3C
Partition Magic recovery partition
66–69
Novell partitions
81
Linux
82
Linux swap partition (can also be associated with Solaris partitions)
83
Linux native file systems (Ext2, Ext3, Ext4, Reiser, Xiafs)
86
FAT16 volume/stripe set (Windows NT)
87
High Performance File System (HPFS) fault-tolerant mirrored partition or NTFS
volume/stripe set
A5
FreeBSD and BSD/386
A6
OpenBSD
A9
NetBSD
C7
Typical of a corrupted NTFS volume/stripe set
EB
BeOS
ª Cengage Learningâ
The partition table is in the Master Boot Record (MBR), located at sector 0 of the disk drive.
In a hexadecimal editor, such as WinHex, you can find the first partition starting at offset
0x1BE. The second partition starts at 0x1CE, the third partition starts at 0x1DE, and the
fourth partition starts at 0x1EE (see Figure 5-4).
The file system’s hexadecimal code is offset 3 bytes from 0x1BE for the first partition.
The sector address of where this partition starts on the drive is offset 8 bytes from
0x1BE. The number of sectors assigned to the partition are offset 12 bytes for position
0x1BE. These offsets are duplicated for any additional partitions created on the disk, as
shown in Figure 5-4. For the extended part of the drive, all partitions are logical partitions. In the first logical partition’s boot sector, there’s a partition table similar to the
MBR.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Exploring Microsoft File Structures
191
0x0800 = 2048
0x01388800 = 20482048
0x03A98800 = 61442048
0x061A8800 = 102404096
5
Partition table starting
position offsets from offset 0
1st partition offset 0x1BE
2nd partition offset 0x1CE
3rd partition offset 0x1DE
4th partition offset 0x1EE
Partition file
system codes
First sector for each partition
converted to decimal
0x0800 = 2048
Number of sectors in each partition
converted to decimal
0x01388000 = 20480000
0x01388800 = 20482048
0x02710000 = 40960000
0x03A98800 = 61442048
0x02710000 = 40960000
0x061A0000 = 102404096
0x341CD000 = 874303488
Figure 5-4 The partition table in a hexidecimal editor
Courtesy of X-Ways AG, www.x-ways.net
Before beginning the following activity, create a WorknChap05n
Chapter work folder on your system.
In some instances, you might need to identify the OS on an unknown disk. You can use
WinHex or another hexadecimal editor, such as Hex Workshop, for this task. The following
steps show you how to determine a disk’s OS by using WinHex:
1. Copy WinHex from this book’s DVD (or download WinHex at http://x-ways.net/
winhex/index-m.html) and install it. Check with your instructor about where you
should install it on your computer.
2. Insert a USB drive into a USB port.
3. In Windows 8 or later, go to the Start screen, type WinHex, and press Enter. Rightclick the WinHex icon and click Run as administrator. In older Windows OSs, rightclick the WinHex desktop icon and click Run as administrator, and then click Continue or Yes in the UAC message box. (In Windows XP or earlier, simply double-click
the WinHex desktop icon.)
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
192
Chapter 5
In Windows 8 or later, it’s recommended that you create a shortcut in
File Explorer for the WinHex.exe file, which is usually in the
C:nProgram Files (x86)nWinHex folder. To start the program, you
right-click the WinHex desktop icon and click “Run as administrator.”
When starting WinHex in Windows 8, you might get a “Windows Protected your PC” warning message. In this case, click More Info, and then
click “Run anyway.” When attempting to access a disk drive in WinHex, if
you get an error message stating that administrator privileges are missing,
click Yes in the Restart WinHex now message box. When restarting
WinHex, click Yes in the UAC message box.
4. Click Tools, Open Disk from the menu to see a list of logical drives. Click the C drive
(or your working drive), and click OK. Figure 5-5 shows a typical hard disk in the
WinHex window. If an error message is displayed, you can ignore it because it won’t
affect your analysis for this activity.
Indicates the file system
Figure 5-5 WinHex identifying the file system
Courtesy of X-Ways AG, www.x-ways.net
The C drive displays “.R.NTFS” if the partition is formatted as an NTFS drive.
If it’s a FAT drive, it displays MSD0S5.0 or MSWIN4.1 in the first logical sector,
which is sector 0 of the partition. Note that the physical drive’s sector 0 is the
drive’s boot sector and is not associated with the partition’s sector 0 location.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Exploring Microsoft File Structures
193
5. Click Tools, Open Disk again, but this time, click your USB drive in the Edit Disk list,
and then click OK. Compare the file system label for this drive with the one you saw in
Step 4. Leave WinHex open for the next activity.
With tools such as WinHex, you can also identify file headers to determine the file types,
with or without an extension. Before performing the following steps in WinHex, use File
Explorer or My Computer to find a folder on your system containing a bitmap (.bmp)
file and a folder containing a Word document (.doc). (In the Hands-On Projects, you
apply these techniques to other file types.) Then follow these steps:
1. To open a bitmap file on your computer, click File, Open from the WinHex menu (the
main menu, not the File item in the Case Data menu). In the Open Files dialog box,
navigate to a folder containing a bitmap file, and then double-click the .bmp file. If
you get a WinHex evaluation warning message, click OK to continue.
2. As shown in Figure 5-6, the WinHex window identifies the file type for the graphic.
For .bmp files, it shows “BM6,” “BM,” or “BMF.” As shown in the figure, “42 4D”
is also displayed to indicate a BM file signature.
Indicates a .bmp file
Also indicates a .bmp file
Figure 5-6 WinHex indicating a .bmp file
Courtesy of X-Ways AG, www.x-ways.net
3. To open an Office 2003 or later Word document, click File, Open from the menu.
Navigate to a folder containing a Word document file, and then double-click the .doc
file. As shown in Figure 5-7, the first line contains a row of 0s followed by “D0 CF 11
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
194
Chapter 5
E0 A1 B1 1A E1,” which identifies the file as a Microsoft Office (before Office 2007)
document. The same file header is displayed for an Excel or a PowerPoint file but
doesn’t apply to Access databases. For Microsoft Office 2007 and later, the first two
characters are “PK” or “OOXML,” which represent a compressed file.
Indicates a Microsoft Office 2003 file
Figure 5-7 WinHex indicating a Microsoft Office file
Courtesy of X-Ways AG, www.x-ways.net
4. Exit WinHex.
Depending on the hexadecimal editor, hex values can be grouped in
sets of two or four digits.
Examining FAT Disks
File Allocation Table (FAT) is the file structure database that Microsoft designed for floppy
disks. It’s used to organize files on a disk so that the OS can find the files it needs. Since its development, other OSs, such as Linux and Macintosh, can format, read, and write to FAT
storage devices such as USB drives and SD cards. The FAT database is typically written to a
disk’s outermost track and contains filenames, directory names, date and time stamps, the
starting cluster number, and file attributes (archive, hidden, system, and read-only).
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Exploring Microsoft File Structures
195
There are three current versions of FAT—FAT16, FAT32, and exFAT (used by Xbox game
systems)—and three older FAT formats, which are FATX, Virtual FAT (VFAT), and FAT12.
The FAT version in Microsoft DOS 6.22 had a limitation of eight characters for filenames
and three characters for extensions. The following list summarizes the evolution of FAT
versions:
•
FAT12—This version is used specifically for floppy disks, so it has a limited amount of
storage space. It was originally designed for MS-DOS 1.0, the first Microsoft OS, used
for floppy disk drives and drives up to 16 MB.
•
FAT16—To handle larger disks, Microsoft developed FAT16, which is still used on
older Microsoft OSs, such as MS-DOS 3.0 through 6.22, Windows 95 (first release),
and Windows NT 3.5 and 4.0. FAT16 supports disk partitions with a maximum
storage capacity of 4 GB.
•
FAT32—When disk technology improved and disks larger than 2 GB were developed,
Microsoft released FAT32, which can access larger drives.
•
exFAT—Developed for mobile personal storage devices, such as flash memory devices,
secure digital eXtended capacity (SDCX), and memory sticks. The exFAT file system
can store very large files, such as digital images, video, and audio files.
•
VFAT—Developed to handle files with more than eight-character filenames and threecharacter extensions; introduced with Windows 95. VFAT is an extension of other
FAT file systems.
Cluster sizes vary according to the hard disk size and file system. Table 5-2 lists the number
of sectors and bytes assigned to a cluster on FAT16 disk according to hard disk size. For
FAT32 file systems, cluster sizes are determined by the OS. Clusters can range from 1 sector
consisting of 512 bytes to 128 sectors of 64 KB.
Table 5-2 Sectors and bytes per cluster
Drive size
Sectors per cluster
FAT16
8–32 MB
1
512 bytes
32–64 MB
2
1 KB
64–128 MB
4
2 KB
128–256 MB
8
4 KB
256–512 MB
16
8 KB
512–1024 MB
32
16 KB
1024–2048 MB
64
32 KB
2048–4096 MB
128
64 KB
ª 2016 Cengage Learningâ
Microsoft OSs allocate disk space for files by clusters. This practice results in drive slack,
composed of the unused space in a cluster between the end of an active file’s content and the
end of the cluster. Drive slack includes RAM slack (found mainly in older Microsoft OSs)
and file slack. In newer Windows OSs, when data is written to disk, the remaining RAM
slack is zeroed out and contains no RAM data.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
196
Chapter 5
For example, suppose you create a text document containing 5000 characters—that is, 5000
bytes of data. If you save this file on a FAT16 1.6 GB disk, a Microsoft OS reserves one
cluster for it automatically. For a 1.6 GB disk, the OS allocates about 32,000 bytes, or 64
sectors (512 bytes per sector), for your file. The unused space, 27,000 bytes, is the file slack
(see Figure 5-8). That is, RAM slack is the portion of the last sector used in the last assigned
cluster, and the remaining sectors are referred to as “file slack.” The 5000-byte text document uses up 10 sectors, or 5120 bytes, so 120 bytes of a sector aren’t used; however, DOS
must write in full 512-byte chunks of data (sectors). The data to fill the 120-byte void is
pulled from RAM and placed in the area between the end of the file (EOF) and the end of
the last sector used by the active file in the cluster. Any information in RAM at that point,
such as logon IDs or passwords, is placed in RAM slack on older Microsoft OSs when you
save a file. File fragments, deleted e-mails, and passwords are often found in RAM and file
slack.
Figure 5-8 File slack space
ª Cengage Learningâ
An unintentional side effect of FAT16 allowing large clusters was that it reduced fragmentation as cluster size increased. The OS added extra data to the end of the file and
allowed the file to expand to this assigned cluster until it consumed the remaining reserved 27,000 bytes. This increased cluster size resulted in inefficient use of disk space.
Because of this inefficient allocation of sectors to clusters, when nearly full FAT16 drives
were converted to FAT32, users discovered they had a lot of extra free disk space
because the files wasted less space.
When you run out of room for an allocated cluster, the OS allocates another cluster for your
file. As files grow and require more disk space, assigned clusters are chained together. Typically, chained clusters are contiguous on the disk. However, as some files are created and
deleted and other files are expanded, the chain can be broken or fragmented. With a tool such
as ProDiscover, you can view the cluster-chaining sequence and see how FAT addresses linking clusters to one another (see Figure 5-9).
When the OS stores data in a FAT file system, it assigns a starting cluster position to a file.
Data for the file is written to the first sector of the first assigned cluster. When this first
assigned cluster is filled and runs out of room, FAT assigns the next available cluster to the
file. If the next available cluster isn’t contiguous to the current cluster, the file becomes fragmented. In the FAT for each cluster on the volume (the partitioned disk), the OS writes the
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining NTFS Disks
197
Figure 5-9 Chained sectors associated with clusters as a result of increasing file size
Courtesy of Technology Pathways, LLC
address of the next assigned cluster. Think of clusters as buckets that can hold a specific number of bytes. When a cluster (or bucket) fills up, the OS allocates another cluster to collect the
extra data.
On rare occasions, such as a system failure or sabotage, these cluster chains can break. If they
do, data can be lost because it’s no longer associated with the previous chained cluster. FAT
looks forward for the next cluster assignment but doesn’t provide pointers to the previous
cluster. Rebuilding these broken chains can be difficult.
Many recent disk forensics tools have automated much of the filerebuilding process. These improved features make recovering data
easier.
Deleting FAT Files When a file is deleted in Windows Explorer or with the MS-DOS
delete command, the OS inserts a HEX E5 (0xE5) in the filename’s first letter position in
the associated directory entry. This value tells the OS that the file is no longer available and a
new file can be written to the same cluster location.
In the FAT file system, when a file is deleted, the only modifications made are that the directory entry is marked as a deleted file, with the HEX E5 character replacing the first letter of
the filename, and the FAT chain for that file is set to 0. The data in the file remains on the
disk drive. The area of the disk where the deleted file resides becomes unallocated disk space
(also called “free disk space”). The unallocated disk space is now available to receive new
data from newly created files or other files needing more space as they grow. Most forensics
tools can recover data still residing in this area.
Examining NTFS Disks
NT File System (NTFS) was introduced when Microsoft created Windows NT and is still the
main file system in Windows 8. Each generation of Windows since NT has included minor
changes in NTFS configuration and features. The NTFS design was partially based on, and
incorporated many features from, Microsoft’s project for IBM with the OS/2 operating system;
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
198
Chapter 5
in this OS, the file system was High Performance File System (HPFS). When Microsoft created
Windows NT, it provided backward-compatibility so that NT could read OS/2 HPFS disk
drives. Since the release of Windows 2000, this backward-compatibility is no longer available.
For a detailed explanation of NTFS structures, see www.ntfs.com/ntfs basics.htm.
NTFS offers substantial improvements over FAT file systems. It provides more information
about a file, including security features, file ownership, and other file attributes. With NTFS,
you also have more control over files and folders (directories) than with FAT file systems.
NTFS was Microsoft’s move toward a journaling file system. The system keeps track of transactions such as file deleting or saving. This journaling feature is helpful because it records a
transaction before the system carries it out. That way, in a power failure or other interruption, the system can complete the transaction or go back to the last good setting.
In NTFS, everything written to the disk is considered a file. On an NTFS disk, the first
data set is the Partition Boot Sector, which starts at sector [0] of the disk and can
expand to 16 sectors. Immediately after the Partition Boot Sector is the Master File Table
(MFT). The MFT, similar to FAT in earlier Microsoft OSs, is the first file on the disk.
An MFT file is created at the same time a disk partition is formatted as an NTFS volume
and usually consumes about 12.5% of the disk when it’s created. As data is added, the
MFT can expand to take up 50% of the disk. (The MFT is covered in more detail in
“NTFS System Files.”)
An important advantage of NTFS over FAT is that it results in much less file slack space.
Compare the cluster sizes in Table 5-3 with Table 5-2, which showed FAT cluster sizes.
Clusters are smaller for smaller disk drives. This feature saves more space on all disks
using NTFS.
Table 5-3 Cluster sizes in an NTFS disk
Drive size
Sectors per cluster
Cluster size
7–512 MB
8
4 KB
512 MB–1 GB
8
4 KB
1–2 GB
8
4 KB
2 GB–2 TB
8
4 KB
2–16 TB
8
4 KB
16–32 TB
16
8 KB
32–64 TB
32
16 KB
64–128 TB
64
32 KB
128
64 KB
128–256 TB
â
ª 2016 Cengage Learning
For more information on Microsoft file system sizes, see
http://support.microsoft.com/kb/140365.
NTFS (and VFAT for long filenames) also uses Unicode, an international data format. Unlike
the American Standard Code for Information Interchange (ASCII) 8-bit configuration,
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining NTFS Disks
199
Unicode uses an 8-bit, a 16-bit, or a 32-bit configuration. These configurations are known as
UTF-8 (Unicode Transformation Format), UTF-16, and UTF-32. For Western-language
alphabetic characters, UTF-8 is identical to ASCII (see www.unicode.org/versions for more
details). Knowing this feature of Unicode comes in handy when you perform keyword
searches for evidence on a disk drive. (This feature is discussed in more detail in Chapter 9.)
Because NTFS offers many more features than FAT, more utilities are used to manage it.
NTFS System Files
Because everything on an NTFS disk is a file, the first file, the MFT, contains information
about all files on the disk, including the system files the OS uses. In the MFT, the first 15
records are reserved for system files. Records in the MFT are referred to as metadata. Table
5-4 lists the first 16 metadata records you find in the MFT.
Table 5-4 Metadata records in the MFT
Filename
System file
Record position Description
$Mft
MFT
0
Base file record for each folder on the NTFS
volume; other record positions in the MFT are
allocated if more space is needed.
$MftMirr
MFT 2
1
The first four records of the MFT are saved in
this position. If a single sector fails in the first
MFT, the records can be restored, allowing
recovery of the MFT.
$LogFile
Log file
2
Previous transactions are stored here to allow
recovery after a system failure in the NTFS
volume.
$Volume
Volume
3
Information specific to the volume, such as
label and version, is stored here.
$AttrDef
Attribute definitions
4
A table listing attribute names, numbers, and
definitions.
$
Root filename index
5
This is the root folder on the NTFS volume.
$Bitmap
Cluster bitmap
6
A map of the NTFS partition shows which
clusters are in use and which are available.
$Boot
Boot sector
7
Used to mount the NTFS volume during the
bootstrap process; additional code is listed
here if it’s the boot drive for the system.
$BadClus
Bad cluster file
8
For clusters that have unrecoverable errors, an
entry of the cluster location is made in this file.
$Secure
Security file
9
Unique security descriptors for the volume are
listed in this file. It’s where the access control
list (ACL) is maintained for all files and folders
on the NTFS volume.
$Upcase
Upcase table
10
Converts all lowercase characters to uppercase
Unicode characters for the NTFS volume.
$Extend
NTFS extension file
11
Optional extensions are listed here, such as
quotas, object identifiers, and reparse point data.
12–15
Reserved for future use.
ª 2016 Cengage Learning
â
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
200
Chapter 5
MFT and File Attributes
When Microsoft introduced NTFS, the way the OS stores data on disks changed substantially. In the NTFS MFT, all files and folders are stored in separate records of 1024 bytes
each. Each record contains file or folder information. This information is divided into record
fields containing metadata about the file or folder and the file’s data or links to the file’s data.
A record field is referred to as an attribute ID.
File or folder information is typically stored in one of two ways in an MFT record: resident
and nonresident. For very small files, about 512 bytes or less, all file metadata and data are
stored in the MFT record. These types of records are called resident files because all their information is stored in the MFT record.
Files larger than 512 bytes are stored outside the MFT. The file or folder’s MFT record provides cluster addresses where the file is stored on the drive’s partition. These cluster addresses
are called data runs. This type of MFT record is referred to as “nonresident” because the
file’s data is stored in its own separate file outside the MFT.
Each MFT record starts with a header identifying it as a resident or nonresident attribute.
The first 4 bytes (characters) for all MFT records are FILE. The header information contains
additional data specifying where the first attribute ID starts, which is typically at offset 0x14
from the beginning of the record. Each attribute ID has a length value in hexadecimal defining where it ends and where the next attribute starts. The length value is located 4 bytes from
the attribute ID.
Table 5-5 lists the types of attributes in an MFT record. For more details on how the MFT
is configured, search on MFT and NTFS at http://technet.microsoft.com/en-us/library/
cc781134.aspx.
Table 5-5 Attributes in the MFT
Attribute ID
Purpose
0x10
$Standard Information
This field contains data on file creation, alterations, MFT changes, read dates and
times, and DOS file permissions.
0x20
$Attribute List
Attributes that don’t fit in the MFT (nonresident attributes) are listed here along
with their locations.
0x30
$File Name
The long and short names for a file are contained here. Up to 255 Unicode bytes are
available for long filenames. For POSIX requirements, additional names or hard links
can also be listed. Files with short filenames have only one attribute ID 0x30. Long
filenames have two attribute ID 0x30s in the MFT record: one for the short name
and one for the long name.
0x40
$Object ID ($Volume Version in Windows NT)
Ownership and who has access rights to the file or folder are listed here. Every MFT
record is assigned a unique GUID. Depending on your NTFS setup, some file records
might not contain this attribute ID.
0x50
$Security Descriptor
Contains the access control list (ACL) for the file.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining NTFS Disks
201
Table 5-5 Attributes in the MFT (Continued )
Attribute ID
Purpose
0x60
$Volume Name
The volume-unique file identifier is listed here. Not all files need this unique
identifier.
0x70
$Volume Information
This field indicates the version and state of the volume.
0x80
$Data
0x90
$Index Root
0xA0
$Index Allocation
File data for resident files or data runs for nonresident files.
Implemented for use of folders and indexes.
Implemented for use of folders and indexes.
0xB0
$Bitmap
A bitmap indicating cluster status, such as which clusters are in use and which are
available.
0xC0
$Reparse Point
This field is used for volume mount points and Installable File System (IFS) filter
drivers.
For the IFS, it marks specific files used by drivers.
0xD0
$EA lnformation
For use with OS/2 HPFS.
0xE0
For use with OS/2 HPFS.
0x100
$Logged Utility Stream
This field is used by Encrypting File System (EFS) in Windows 2000 and later
ª 2016 Cengage Learningâ
Figure 5-10 is an MFT record showing the resident attributes of a small file viewed in a hexadecimal editor. Note that on line 035B3530 near the bottom, there’s text data in the right
pane. In Figure 5-11, the bottom half of the hexadecimal editor window shows the remaining
portion of this resident file’s MFT record.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
202
Chapter 5
D
A
H
I
J
E
B
C
K
F
G
A: All MFT records start with FILE0
B: Start of attribute 0x10
C: Length of attribute 0x10 (value 60)
D: Start of attribute 0x30
E: Length of attribute 0x30 (value 70)
F: Start of attribute 0x40
G: Length of attribute 0x40 (value 28)
H: Start of attribute 0x80
I: Length of attribute 0x80 (value 70)
J: Attribute 0x80 resident flag
K: Starting position of resident data
Figure 5-10 Resident file in an MFT record
Courtesy of X-Ways AG, www.x-ways.net
A: Starting position of attribute 0x80 $Data
B: Length of attribute 0x80 in little endian format
C: Interpreted little endian value
Figure 5-11 File data for a resident file
Courtesy of X-Ways AG, www.x-ways.net
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining NTFS Disks
203
Figure 5-12 is an example of a nonresident file’s hexadecimal view. Notice that on line
35B3D50 near the bottom, there’s no text data. This file is a longer version of the file shown
in Figure 5-10. Current forensics tools, such as ProDiscover, EnCase, FTK, and X-Ways
Forensics, can interpret the MFT from an image file.
5
A
D
B
C
E
A: Start of nonresident attribute 0x80
B: Length of nonresident attribute 0x80
C: Attribute 0x80 nonresident flag
D: Starting point of data run
E: End-of-record marker (FF FF FF FF) for the MFT record
Figure 5-12 Nonresident file in an MFT record
Courtesy of X-Ways AG, www.x-ways.net
To understand how data runs are assigned for nonresident MFT records, you should know
that when a disk is created as an NTFS file structure, the OS assigns logical clusters to the
entire disk partition. These assigned clusters, called logical cluster numbers (LCNs), are
sequentially numbered from the beginning of the disk partition, starting with the value 0.
LCNs become the addresses that allow the MFT to link to nonresident files (files outside the
MFT) on the disk’s partition.
When data is first written to nonresident files, an LCN address is assigned to the file in the attribute 0x80 field of the MFT. This LCN becomes the file’s virtual cluster number (VCN),
which is listed as zero: VCN(0). If there’s not enough space at VCN(0)’s location because of
excessive disk fragmentation another data run is added. More VCNs are added as needed,
and each additional VCN is sequentially numbered as VCN(1), VCN(2), and so on until all
data is written to the drive.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
204
Chapter 5
The value in VCN(0) is the first cluster for the file; this value is the cluster’s actual LCN.
VCN(1) and other VCNs are the offset of the cluster’s number from the previous VCN cluster
position in the data run. For example, to determine the next data run location for VCN(0)
for a fragmented file, simply add VCN(0)’s LCN value to the next VCN’s offset value. So if
VCN(0)’s LCN is 10000 and VCN(1) is 120, add VCN(1)’s 120 to VCN(0)’s LCN value of
10000 to get the starting LCN cluster for VCN(1), which is the LCN address 10120. If the
file is fragmented more and there’s a VCN(2), add VCN(1)’s LCN value to VCN(2)’s LCN
value. This process is repeated for any additional VCNs assigned to a file.
VCNs are also signed integers so that if the next largest unused disk space is at a lower
address than the previous VCN, the lower value address can be computed by simply adding a
negative number to the VCN. For example, if the previous VCN data run is at offset
3000000 and the next available open area to receive data is at LCN 2900000, the VCN
is -100000 (3000000 1 [-100000] ¼ 2900000).
The following two sections explain the basic configuration of resident and nonresident files
managed by the MFT. By learning how data is stored in the MFT, a forensics examiner can
manually reconstruct any residual data on NTFS-formatted disk media. You need to understand how these offsets are calculated for activities in Chapter 16.
The following descriptions of the values and functions of NTFS and the MFT aren’t exhaustive, and future Windows updates could change these configurations. This discussion should
be used as a quick reference for locating and interpreting data artifacts where you might find
residual fragments from partially overwritten MFT records.
MFT Structures for File Data
When you’re viewing an MFT record with a hexadecimal editor, the data is displayed in little
endian format, meaning it’s read from right to left. For example, the hexadecimal value 400
is displayed as 00 04 00 00, and the number 0x40000 is displayed as 00 00 04 00.
The first section of an MFT record is the header that defines the size and starting position of the
first attribute. Following the header are attributes that are specific for the file type, such as an
application file or a data file. MFT records for directories and system files have additional
attributes that don’t appear in a file MFT record. The following sections explain how data files
are configured in the MFT. In Chapter 16, you see how these fields apply to data recovery.
MFT Header Fields For the header of all MFT records, the record fields of interest are
as follows:
•
At offset 0x00—The MFT record identifier FILE; the letter F is at offset 0.
•
At offset 0x1C to 0x1F—Size of the MFT record; the default is 0x400 (1024) bytes, or
two sectors.
•
At offset 0x14—Length of the header, which indicates where the next attribute starts;
it’s typically 0x38 bytes.
•
At offset 0x32 and 0x33—The update sequence array, which stores the last 2 bytes of
the first sector of the MFT record. It’s used only when MFT data exceeds 512 bytes.
The update sequence array is used as a checksum for record integrity validation.
Figure 5-13 shows these fields and their relationships in the MFT record.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining NTFS Disks
MFT record identifier
Length of the
MFT record header
Update sequence array: This data
goes into position/offset IE and IF
205
Size of the entire MFT record
Note: This data is swapped with data in
position IE and IF of the MFT record
Figure 5-13 An MFT header
Courtesy of X-Ways AG, www.x-ways.net
Attribute 0x10: Standard Information Following the MFT header for a data file
is the Standard Information attribute, 0x10, which has the following fields (see Figure 5-14):
•
At offset 0x38 from the beginning of the MFT record—The start of attribute 0x10.
•
At offset 0x04 and 0x05 from the beginning of attribute 0x10—Size of the 0x10
attribute.
•
At offset 0x18 to 0x1F—The file’s create date and time; all dates and times are stored
in the Win32 Filetime format.
•
At offset 0x20 to 0x27—The last modified date and time for the file.
•
At offset 0x28 to 0x2F—The last access date and time.
•
At offset 0x30 to 0x2F—The record access date and time.
Create date and time
Attribute 0x10
Last access date and time
Last modified date
and time
Size of attribute
0x10
Record update date and time
Figure 5-14 Attribute 0x10: Standard Information
Courtesy of X-Ways AG, www.x-ways.net
Attribute 0x30: File Name For files with filenames of eight or fewer characters, the
MFT record has only one attribute 0x30. If a filename is longer than eight characters, there
are two attribute 0x30s. The following description shows an MFT record with a short and
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
206
Chapter 5
long filename in attribute 0x30. The fields of interest for the short filename attribute 0x30 are
as follows:
•
At offset 0x04 and 0x05 from the beginning of attribute 0x30—The size of attribute 0x30.
•
At offset 0x5A from the 0x30 attribute’s starting position—The short filename; note
that it’s in Unicode.
•
At offset 0x20 to 0x27—The file’s create date and time; all dates and times are stored
in Win32 Filetime format.
•
At offset 0x28 to 0x2F—The last modified date and time for the file.
•
At offset 0x30 to 0x37—The last access date and time.
•
At offset 0x38 to 0x3F—The record update date and time.
The date and time values in attribute 0x30 are usually the same as in
attribute 0x10. On occasion, depending how data is copied to a disk
and the Windows OS version, these values might differ substantially.
The following are fields of interest for the long filename attribute 0x30:
•
At offset 0x04 and 0x05 from the beginning of attribute 0x30—The size of attribute 0x30.
•
At offset 0x5A from the 0x30 attribute’s starting position—The long filename; note
that it’s in Unicode.
•
At offset 0x20 to 0x27—The file’s create date and time; all dates and times are stored
in Win32 Filetime format.
•
At offset 0x28 to 0x2F—The last modified date and time for the file.
•
At offset 0x30 to 0x37—The last access date and time.
•
At offset 0x38 to 0x3F—The record update date and time.
Figure 5-15 shows these fields and their relationships in the MFT record.
Attribute 0x40: Object ID Depending on the Windows version, sometimes attribute
0x40 is listed in the MFT. This attribute contains file ownership and access control information and has the following fields:
•
At offset 0x04 and 0x05 from the beginning of attribute 0x40—The size of attribute 0x40
•
At offset 0x14—Starting offset position for GUID data
•
At offset 0x18 to 0x27—Starting position for GUID Object_ID data
In this example, only the GUID Object_ID is listed. In large enterprise systems, typically additional information is listed, such as the following:
•
GUID Birth Volume ID
•
GUID Birth Object ID
•
GUID Birth Domain ID
Figure 5-16 shows these fields and their relationships in the MFT record.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining NTFS Disks
B
A
E
G
F
C
D
207
5
H
I
J
L
N
M
K
A: Attribute 0x30 short filename
B: Size of attribute 0x30 short filename
C: Short create date and time
D: Short last modified date and time
E: Short last access date and time
F: Short record update date and time
G: Starting position of short filename
H: Attribute 0x30 long filename
I: Size of attribute 0x30 long filename
J: Long create date and time
K: Long last modified date and time
L: Long last access date and time
M: Long record update date and time
N: Starting position of long filename
Figure 5-15 Attributes 0x30: short and long filenames
Courtesy of X-Ways AG, www.x-ways.net
Attribute 0x40
Size of attribute 0x40
Starting position for GUID data
Starting offset position for
GUID data
Figure 5-16 Attribute 0x40: Object ID
Courtesy of X-Ways AG, www.x-ways.net
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
208
Chapter 5
Attribute 0x80: Data for a Resident File For a resident file’s attribute 0x80,
the fields of interest are as follows (see Figure 5-17):
•
At offset 0x04 and 0x05 from the beginning of attribute 0x80—Size of the attribute.
•
At offset 0x08—The resident/nonresident flag; for resident data, it’s set to 0x00.
•
At offset 0x10—Number of bytes in the data run.
•
At offset 0x18—Start of the resident data run.
•
At offset 0x1E and 0x1F from the beginning of the MFT header—The sector checksum
value, used to validate the first 512 bytes of the MFT record. The break between the
first and second sectors is referred to as the sector boundary. The 2 bytes at positions
0x32 and 0x33 of the MFT header in the update sequence array field are where the
actual values for these bytes are stored.
The end of the MFT record is indicated by the hexadecimal values FF FF FF FF at the end of
the record.
Resident flag
Start of attribute 0x80
Start of resident data run
Sector boundary
Size of attribute 0x80
Number of bytes
allocated for data
Sector checksum
Figure 5-17 Attribute 0x80: Data for a resident file
Courtesy of X-Ways AG, www.x-ways.net
Attribute 0x80: Data for a Nonresident File For a nonresident file, the fields
of interest for attribute 0x80 are as follows:
•
At offset 0x04 and 0x05 from the beginning of attribute 0x80—Size of the
attribute.
•
At offset 0x08—The resident/nonresident flag; for nonresident data, it’s set to 0x01.
•
At offset 0x40—The start of the data run. The first run is the LCN; if the file is fragmented, additional data runs follow, as shown in Figure 5-18. In this example, there
are a total of six data runs, which means this file has several fragments.
Following the last data run, the value 0x00 indicates the end of the Data attribute. Figure 5-18
shows these fields and their relationships in the MFT record.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining NTFS Disks
209
5
B
A
C
D
G
H
I
J
E
F
A: Start of attribute 0x80
B: Size of attribute 0x80
C: Nonresident flag
D: First data run
E: Second data run
F: Additional data runs
G: End of data run
H: End of MFT record
I: Sector checksum
J: Sector boundary
Figure 5-18 Attribute 0x80: Data for a nonresident file
Courtesy of X-Ways AG, www.x-ways.net
Interpreting a Data Run As discussed, the first data run for a nonresident attribute
0x80 field starts at offset 0x40 from the beginning of the attribute. In this discussion, a file
called SanteFe001.jpg is used as an example of how data runs are interpreted. Data runs
have three components: The first component declares how many bytes in the attribute field
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
210
Chapter 5
are needed to store the values for the second and third components. The second component
stores the number of clusters assigned to the data run, and the third component contains the
starting cluster address value (the LCN or the VCN). This discussion uses a file with six fragments (data runs).
For the first component—the 32 shown in Figure 5-19 as the data run’s starting
position—the second digit, 2, means that the next 2 bytes contain the number of clusters
assigned to this data run. The first digit, 3, means that the next 3 bytes (after the number
of clusters assigned) contain the cluster address value VCN(0); for the first data run, this
value is the LCN.
Starting position of each data run
End of data run marker
End of MFT record
Checksum for first sector
(see update sequence array
in MFT header field)
Figure 5-19 Multiple data runs
Courtesy of X-Ways AG, www.x-ways.net
In Figure 5-20, the second component shows the 2 bytes needed to store the hexadecimal
value (in little endian) for the number of clusters assigned to this data run. The number of
clusters assigned to this data run is 7B1 (hexadecimal) or 1969 in decimal.
First component
Second component
Third component
Figure 5-20 Data run components
Courtesy of X-Ways AG, www.x-ways.net
As shown in Figure 5-21, for the third component, the starting assigned cluster address is
0x8C8C (hexadecimal), or 35980 in decimal. Because it’s the first data run of the file, this
address is the LCN.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining NTFS Disks
Assigned clusters for
the SanteFe001.jpg file
211
First data run (note address match)
5
Number of clusters
assigned to this data run
Bytes needed to store
Starting LCN address
the number of clusters
assigned to this data run
Bytes needed to store
the LCN address value
Figure 5-21 First data run with an LCN address
Courtesy of X-Ways AG, www.x-ways.net
Figures 5-22 and 5-23 show the second and third data runs for the SanteFe001.jpg
file. For the second and all other data runs, the third component is a signed integer; for
example, in Figure 5-22, this value is converted from a hexadecimal number to a negative
decimal number. In NTFS, if the next available open area of a highly fragmented disk is
at a lower address, a negative number is assigned as the VCN value. The way NTFS
navigates to this second open area is by adding the VCN to the previous LCN. For
example, the first data run has the LCN address 35980, and the second data run has the
value -4715. The OS adds the two numbers, but because the second data run has a negative number, they’re actually subtracted: 35980 1 (-4715) ¼ 31265.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
212
Chapter 5
Assigned cluster for
the SanteFe001.jpg file
This VCN value is a negative number
because the next available LCN is at
a lower address than the first LCN data run.
VCN value for the address
of the next disk location
Figure 5-22 Second data run with a VCN address
Courtesy of X-Ways AG, www.x-ways.net
As you can see in the assigned cluster lists in Figure 5-23, the second fragment has a starting
cluster number (an LCN) of 31265. In the third data run, the VCN value is a positive
number.
For additional information on NTFS and its design, see http://dubeyko.
com/development/FileSystems/NTFS/ntfsdoc.pdf or http://download.
paragon-software.com/doc/manual_NTFS-HFS_for_Linux_8.1_User_
Manual.pdf.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining NTFS Disks
213
5
Figure 5-23 Third data run with a VCN address
Courtesy of X-Ways AG, www.x-ways.net
NTFS Alternate Data Streams
Of particular interest when you’re examining NTFS disks are alternate data streams,
which are ways data can be appended to existing files. When you’re examining a disk, be
aware that alternate data streams can obscure valuable evidentiary data, intentionally or
by coincidence.
In NTFS, an alternate data stream becomes an additional file attribute and allows the file to
be associated with different applications. As a result, it remains one data unit. You can also
store information about a file in an alternate data stream. In its resource documentation Web
page, Microsoft states: “For example, a graphics program can store a thumbnail image of a
bitmap in a named data stream within the NTFS file containing the image.” At a command
prompt in Windows NT and later, you can create an alternate data stream with this DOS
command:
C:necho text_string> my file.txt:stream_name
You can also use the following type command to redirect the contents of a small file to an
alternate data stream:
C:ntype textfile.txt [ my file.txt:streaml
In these commands, the alternate data stream is defined in the MFT by the colon between the
file extension and the stream label. To display an alternate data stream’s content as a simple
text string, use this command:
C:nmore \ my file.txt:stream1
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
214
Chapter 5
If you save a file with alternate data streams attached to a FAT volume, the alternate data streams aren’t transferred.
If you perform a keyword search and retrieve a file associated with a keyword, you might not
be able to open the alternate data stream. An alternate data stream isn’t displayed when you
open a file in a text editor. The only way you can tell whether a file has an alternate data
stream attached is by examining the file’s MFT record entry. Figure 5-24 shows the MFT
record of a file containing a text alternate data stream. Note that there are two attribute
0x80 fields.
Second attribute 0x80
Start of data run for second attribute
0x80 (location of hidden alternate data stream)
Size of second attribute 0x80
Figure 5-24 A text alternate data stream
Courtesy of X-Ways AG, www.x-ways.net
Figure 5-25 shows what larger nonresident files look like in an MFT record. Note that the
sector boundary’s checksum value (item R) must be swapped with the update sequence
array’s value (item C).
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining NTFS Disks
F
C
G
D
A
B
215
E
5
K
M
P
I
N
L
A: Attribute 0x10
B: Attribute 0x10 size
C: Update sequence array
D: Attribute 0x30 short filename
E: Attribute 0x30 size short filename
F: Attribute 0x30 long filename
G: Attribute 0x30 size long filename
H: Sector boundary
I: First attribute 0x80
O
J
R
H
J: Size of attribute
K: Nonresident flag
L: Start of first data run
M: Second attribute 0x80
N: Size of attribute
O: Nonresident flag
P: Start of second data run
R: Sector boundary’s checksum
Figure 5-25 A nonresident alternate data stream
Courtesy of X-Ways AG, www.x-ways.net
NTFS Compressed Files
To improve data storage on disk drives, NTFS provides compression similar to FAT DriveSpace 3, a Windows 98 compression utility. With NTFS, you can compress files, folders, or
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
216
Chapter 5
entire volumes. With FAT16, you can compress only a volume. On a Windows NT or later
system, compressed data is displayed normally when you view it in Windows Explorer or
applications such as Microsoft Word.
During an investigation, typically you work from an image of a compressed disk, folder, or
file. Most forensics tools can uncompress and analyze compressed Windows data, including
data compressed with the Lempel-Ziv-Huffman (LZH) algorithm and in formats such as
PKZip, WinZip, and GNU gzip. However, forensics tools might have difficulty with thirdparty compression utilities, such as the .rar format. If you identify third-party compressed
data, you need to uncompress it with the utility that created it.
NTFS Encrypting File System
When Microsoft introduced Windows 2000, it added optional built-in encryption to NTFS
called Encrypting File System (EFS). EFS uses public key and private key methods of encrypting files, folders, or disk volumes (partitions). Only the owner or user who encrypted the data
can access encrypted files. The owner holds the private key, and the public key is held by
a certification authority, such as a global registry, network server, or company such as
VeriSign.
When EFS is used in Windows 2000 and later, a recovery certificate is generated and sent to
the local Windows administrator account. The purpose of the recovery certificate is to provide a mechanism for recovering files encrypted with EFS if there’s a problem with the user’s
original private key. The recovery key is stored in one of two places. When a network user
initiates EFS, the recovery key is sent to the local domain server’s administrator account. On
a stand-alone workstation, the recovery key is sent to the local administrator account.
Users can apply EFS to files stored on their local workstations or a remote server. Windows
2000 and later decrypt the data automatically when a user or an application accesses an EFS
file, folder, or disk volume. In Windows Server 2003 and later, users can grant other users
access to their EFS data. If a user copies a file encrypted with EFS to a folder that isn’t
encrypted, the copied data is saved in unencrypted format.
EFS Recovery Key Agent
The Recovery Key Agent implements the recovery certificate, which is in the Windows administrator account. Windows administrators can recover a key in two ways: through Windows
or from an MS-DOS command prompt. These three commands are available from the
MS-DOS command prompt:
•
cipher
•
copy
•
efsrecvr (used to decrypt EFS files)
For information on how to use these commands, enter the question mark switch after each
command. For example, type cipher /? and press Enter. Encrypted files aren’t part of the
FAT12, FAT16, or FAT32 file systems, so cipher and efsrecvr work only on NTFS systems running Windows 2000 Professional, XP Professional, Vista Business Edition, and 7
and 8 Professional and Enterprise editions. The copy command, however, works in both
FAT and NTFS.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining NTFS Disks
217
In Vista Business Edition and later, Microsoft has added features to the
cipher command that aren’t available when encrypting data in
Windows Explorer or File Explorer. One is the /w switch that overwrites
all deleted files, making them impossible to recover with data recovery
or forensics carving tools.
If you copy an encrypted file from an EFS-enabled NTFS disk or folder
to a non-EFS storage media or folder, it’s unencrypted automatically.
To recover an encrypted EFS file, a user can e-mail it or copy the file to the administrator.
The administrator can then run the Recovery Key Agent function to restore the file. For additional information, review the Microsoft Security Guidance documentation (http://technet.
microsoft.com/en-us/library/cc700811.aspx#XSLTsection125121120120) for the latest procedures on how to recover EFS files.
Deleting NTFS Files
Typically, you use Windows or File Explorer to delete files from a disk. When a file is deleted
in Windows NT and later, the OS renames it and moves it to the Recycle Bin. Another
method is using the del (delete) MS-DOS command. This method doesn’t rename and move
the file to the Recycle Bin, but it eliminates the file from the MFT listing in the same way FAT
does.
When you delete a file in Windows or File Explorer, you can restore it from the Recycle Bin.
The OS takes the following steps when you delete a file or a folder in Windows or File Explorer:
1. Windows changes the filename and moves the file to a subdirectory with a unique identity in the Recycle Bin.
2. Windows stores information about the original path and filename in the Info2 file,
which is the control file for the Recycle Bin. It contains ASCII data, Unicode data, and
the date and time of deletion for each file or folder.
NTFS files deleted at an MS-DOS command prompt function much like FAT files. (The following steps also apply when a user empties the Recycle Bin.) The OS performs the following tasks:
1. The associated clusters are designated as free—that is, marked as available for new
data.
2. The $Bitmap file attribute in the MFT is updated to reflect the file’s deletion, showing
that this space is available.
3. The file’s record in the MFT is marked as being available.
4. VCN/LCN cluster locations linked to deleted nonresident files are then removed from
the original MFT record.
5. A run list is maintained in the MFT of all cluster locations on the disk for nonresident
files. When the list of links is deleted, any reference to the links is lost.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
218
Chapter 5
NTFS is more efficient than FAT at reclaiming deleted space. Deleted
files are overwritten more quickly.
Resilient File System
With the release of Windows Server 2012, Microsoft created a new file system: Resilient File
System (ReFS). ReFS is designed to address very large data storage needs, such as the cloud.
The following features are incorporated into ReFS’s design:
•
Maximized data availability
•
Improved data integrity
•
Designed for scalability
ReFS is an outgrowth of NTFS designed to provide a large-scale data storage access capability. It’s intended only for data storage, so as of this writing, it can’t be used as a boot drive.
Windows 8/8.1 and Windows Server 2012 are the only Windows OSs that can access ReFS
disk drives.
ReFS uses disk structures similar to the MFT in NTFS. Its storage engine uses a B1-tree
sort method for fast access to large data sets. It also uses a method called “allocate-onwrite” that copies updates of data files to new locations; similar to shadow paging, it
prevents overwriting the original data files. The purpose of writing updates to new locations is to ensure that the original data can be recovered easily if a failure occurs in the
update write to disk.
For more information on ReFS and other storage methods, see http://msdn.
microsoft.com/en-us/library/windows/desktop/hh848060(v¼vs.85).aspx or
http://technet.microsoft.com/en-us/library/hh831724.aspx.
Understanding Whole Disk Encryption
Loss of personal identity information (PII) and trade secrets caused by computer theft has
become more of a concern. Company PII might consist of employees’ full names, home
addresses, and Social Security numbers. With this information, criminals could easily
apply for credit card accounts in these employees’ names. Trade secrets are any information a business keeps confidential because it provides a competitive edge over other companies. The inadvertent public release of this information could devastate a business’s
competitive edge.
Of particular concern is the theft of laptop computers and other handheld devices, such as
smartphones. If data on these devices isn’t secured correctly, the owners could be liable for
any damages incurred, such as stolen identities, credit card fraud, or loss of business caused
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding Whole Disk Encryption
219
by the release of trade secrets to the competition. Because of the PII problem, many states
have enacted laws requiring any person or business to notify potential victims of the loss as
soon as possible. To help prevent loss of information, software vendors, including Microsoft,
now provide whole disk encryption (WDE, introduced in Chapter 3). This feature creates
new challenges in examining and recovering data from drives.
Whole disk encryption tools offer the following features that forensics examiners should be
aware of:
•
Preboot authentication, such as a single sign-on password, fingerprint scan, or token
(USB device)
•
Full or partial disk encryption with secure hibernation, such as activating a passwordprotected screen saver
•
Advanced encryption algorithms, such as Advanced Encryption Standard (AES) and
International Data Encryption Algorithm (IDEA)
•
Key management function that uses a challenge-and-response method to reset passwords or passphrases
WDE tools encrypt each sector of a drive separately. Many of these tools encrypt the
drive’s boot sector to prevent any efforts to bypass the secured drive’s partition. To
examine an encrypted drive, you must decrypt it first. An encryption tool’s key management function typically uses a challenge-and-response method for decryption, which
means you must run a vendor-specific program to decrypt the drive. Many vendors use a
bootable CD or USB drive that prompts for a one-time passphrase generated by the key
management function. If you need to decrypt the same computer a second time, you need
a new one-time passphrase.
The biggest drawback to decrypting a drive is the several hours required to read,
decrypt, and write each sector. The larger the drive, the longer decryption takes. After
you’ve decrypted the drive, however, you can use standard acquisition methods to
retrieve data.
Examining Microsoft BitLocker
BitLocker, introduced briefly in Chapter 3, is Microsoft’s utility for protecting drive data. It’s
available in Windows Vista Enterprise and Ultimate editions, Windows 7 and 8 Professional
and Enterprise editions, and Windows Server 2008 and 2012. Guidance Software Encase can
decrypt BitLocker drives, although the process can take a lot of time. BitLocker’s current
hardware and software requirements are as follows:
•
A computer capable of running Windows Vista or later (non-home editions)
•
The Trusted Platform Module (TPM) microchip, version 1.2 or newer
•
A computer BIOS compliant with Trusted Computing Group (TCG)
•
Two NTFS partitions for the OS and an active system volume with available space
•
The BIOS configured so that the hard drive boots first before checking the CD/DVD
drive or other bootable peripherals
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
220
Chapter 5
For more information on BitLocker, see http://technet.microsoft.com/
en-us/library/cc732774.aspx or go to http://technet.microsoft.com and
search on “BitLocker.”
Examining Third-Party Disk Encryption Tools
Several vendors offer third-party WDE utilities that often have more features than BitLocker.
For example, BitLocker can encrypt only NTFS drives. If you want to encrypt a FAT drive,
you need a third-party solution. Decrypting with third-party utilities typically follows the
same process as in BitLocker, with some exceptions. Before using one of these utilities, make
sure you investigate its features thoroughly. The following list describes some available thirdparty WDE utilities:
•
PGP Full Disk Encryption (www.symantec.com/drive-encryption) can be used on PCs,
laptops, and removable media to secure an entire disk volume. This tool works in
Windows 2000, XP Professional (SP1 and SP2), and Mac OS X 10.4 and can also
encrypt FAT volumes.
•
Voltage SecureFile (www.voltage.com/products/voltage-securefile/) is designed for an
enterprise computing environment.
•
Jetico BestCrypt Volume Encryption (www.jetico.com/products/personal-privacy/
bestcrypt-volume-encryption) provides WDE for older MS-DOS and Windows
NTFS systems.
•
TrueCrypt (www.truecrypt.org) creates a virtual encrypted volume—a file mounted as
though it were a disk drive. Data is encrypted automatically and in real time.
With improved encryption methods, extracting digital evidence will become more difficult.
Because of these challenges, you need to know how to make remote live acquisitions, discussed in Chapter 10.
Understanding the Windows Registry
When Microsoft created Windows 95, it consolidated initialization (.ini) files into the
Registry, a database that stores hardware and software configuration information, network
connections, user preferences (including usernames and passwords), and setup information.
The Registry has been updated and is still used in Windows Vista and later.
For investigative purposes, the Registry can contain valuable evidence. To view the Registry, you can use the Regedit (Registry Editor) program for Windows 9x and Regedt32
for Windows 2000, XP, and Vista. For Windows 7 and 8, both Regedit and Regedit32
are available.
For more information on using Regedit and Regedt32, see the
Windows Resource Kit documentation for the OS version. You can
find it at http://support.microsoft.com/kb/141377.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding the Windows Registry
221
In general, you can use the Edit, Find menu command in Registry Editor to locate entries that
might contain trace evidence, such as information identifying the last person who logged on
to the computer, which is usually stored in user account information. You can also use the
Registry to determine the most recently accessed files and peripheral devices. In addition, all
installed programs store information in the Registry, such as Web sites accessed, recent files,
and even chat rooms accessed.
As a digital forensics investigator, you should explore the Registry of all Windows systems.
On a live system, be careful not to alter any Registry setting to avoid corrupting the system
and possibly making it unbootable.
Several third-party tools, such as FTK Registry Viewer, are also available for accessing the Registry.
Exploring the Organization of the Windows Registry
The Windows Registry is organized in a specific way that has changed slightly with each new
version of Windows. However, the major Registry sections have been consistent, with some
minor changes, since Windows 2000; they’re slightly different in Windows 9x/Me. Before
proceeding, review the following list of Registry terminology:
•
Registry—A hierarchical database containing system and user information.
•
Registry Editor—A Windows utility for viewing and modifying data in the Registry.
There are two Registry Editors: Regedit and Regedt32 (introduced in Windows
2000).
•
HKEY—Windows splits the Registry into categories with the prefix HKEY_. Windows
9x systems have six HKEY categories and Windows 2000 and later have five.
Windows programmers refer to the “H” as the handle for the key.
•
Key—Each HKEY contains folders referred to as keys. Keys can contain other key
folders or values.
•
Subkey—A key displayed under another key is a subkey, similar to a subfolder in
Windows or File Explorer.
•
Branch—A key and its contents, including subkeys, make up a branch in the
Registry.
•
Value—A name and value in a key; it’s similar to a file and its data content.
•
Default value—All keys have a default value that may or may not contain data.
•
Hives—Hives are specific branches in HKEY_USER and HKEY_LOCAL_MACHINE.
Hive branches in HKEY_LOCAL_MACHINEnSoftware are SAM, Security, Components, and System. For HKEY_USER, each user account has its own hive link to
Ntuser.dat.
The next piece of the puzzle is learning where data files that the Registry reads are located.
The number of files the Registry uses depends on the Windows version. In Windows 9x/Me,
it uses only two files, User.dat and System.dat. In Windows NT and later, there are six
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
222
Chapter 5
files: Ntuser.dat, System.dat, SAM.dat, Software.dat, Security.dat, and
Default.dat. When examining Registry data from a suspect drive after you have made an
acquisition and are reviewing it in a forensics tool, you need to know the location of these
files. Table 5-6 shows how Registry data files are organized and explains these files’ purposes in Windows Vista and later. For information on older Windows Registry files, see
http://support.microsoft.com/kb/250410.
Table 5-6 Registry file locations and purposes
Filename and location
Purpose of file
Usersnuser-accountnNtuser.dat
User-protected storage area; contains the list of most
recently used files and desktop configuration settings
Windowsnsystem32nconfignDefault.dat
Contains the computer’s system settings
Windowsnsystem32nconfignSAM.dat
Contains user account management and security settings
Windowsnsystem32nconfignSecurity.dat
Contains the computer’s security settings
Windowsnsystem32nconfignSoftware.dat
Contains installed programs’ settings and associated
usernames and passwords
Windowsnsystem32nconfignSystem.dat
Contains additional computer system settings
Windowsnsystem32nconfignsystemprofile
Contains additional NTUSER information
â
ª 2016 Cengage Learning
When viewing the Registry with Registry Editor, you can see the HKEYs used in Windows
(see Figure 5-26).
Figure 5-26 Viewing HKEYs in Registry Editor
Courtesy of Microsoft Corporation
Table 5-7 describes the functions of Registry HKEYs.
For additional information on the Registry, see http://support.
microsoft.com/default.aspx?scid¼kb;EN-US;256986, http://regripper.
wordpress.com, and www.computerhope.com/registry.htm. For a
detailed listing of HKEYs, see www.accessdata.com/technical.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding the Windows Registry
223
Table 5-7 Registry HKEYs and their functions
HKEY
Function
HKEY CLASS ROOT
A symbolic link to HKEY LOCAL MACHINEnSOFTWAREnClasses;
provides file type and file extension information, URL protocol
prefixes, and so forth
HKEY CURRENT USER
A symbolic link to HKEY USERS; stores settings for the currently
logged-on user
HKEY LOCAL MACHINE
Contains information about installed hardware and software
HKEY USERS
Stores information for the currently logged-on user; only one key
in this HKEY is linked to HKEY CURRENT USER
HKEY CURRENT CONFIG
A symbolic link to
HKEY LOCAL MACHINEnSYSTEMnCurrentControlSetnHardware
Profile\xxxx (with xxxx representing the current hardware
profile); contains hardware configuration settings
HKEY DYN DATA
Used only in Windows 9x/Me systems; stores hardware
configuration settings
ª 2016 Cengage Learningâ
Examining the Windows Registry
Some forensics tools, such as ProDiscover, X-Ways Forensics, OSForensics, and FTK, have
built-in or add-on Registry viewers. For this next activity, your company’s Legal Department
has asked you to search for any references to an e-mail addresses containing the name Denise
or Robinson with the domain name outlook.com. A paralegal gives you a raw (dd) image file
containing InCh05.img, a forensic image of a Windows 8 computer’s hard drive used by
Superior Bicycle employee Denise Robinson.
For this activity, you use OSForensics to examine Denise Robinson’s NTUser.dat file. If
you find any items of interest, add them to an OSForensics case report that you can give to
the paralegal. The following steps explain how to generate a case report in OSForensics.
Before beginning this activity, extract compressed files from the
Chap05 folder on the book’s DVD to your WorknChap05nChapter
folder. If necessary, create the Chap05 and Chapter folders first. The
work folder pathname you see in screenshots might differ.
To examine Registry files with OSForensics, follow these steps:
1. Start OSForensics with the Run as administrator option, and click the Continue Using
Free Version.
2. In the left pane, click Manage Case, if necessary. In the Manage Case pane on the right,
click the New Case button. In the New Case dialog box, type InChap05 in the Case
Name text box and your name in the Investigator text box. For the Acquisition
Type setting, click the Investigate Disk(s) from Another Machine option button (see
Figure 5-27). Click Custom Location for the Case Folder option. Click the Browse
button on the lower right, navigate to and click your WorknChap05 folder, and then
click OK twice.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
224
Chapter 5
Figure 5-27 The New Case dialog box
Source: PassMark Software, www.osforensics.com
Notice the drive letter in the OSFMount - Mount drive dialog box,
which you use in Step 4. This image is mounted as read-only as an
attached drive on your computer and becomes accessible to
OSForensics.
3. To mount the disk image, scroll down the navigation bar on the left, and click Mount
Drive Image. In the Mounted virtual disks window, click the Mount new button. In the
OSFMount - Mount drive dialog box that opens (see Figure 5-28), click the … button
next to the Image file text box, navigate to your work folder, click InCh05.img, click
Open, and then click OK.
4. In the navigation bar on the left, click Registry Viewer. In the “Select registry hive file
to open” dialog box, click the Select Drive list arrow, and then click the drive letter that
was shown in Step 3 (see Figure 5-29). The drive letter on your system is likely to be
different. In the list of files on the right, click DriveLetternusersnDenisenNTUSER.
DAT, and then click Open.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding the Windows Registry
225
5
Figure 5-28 Mounting a drive in OSForensics
Source: PassMark Software, www.osforensics.com
Figure 5-29 The “Select registry hive file to open” dialog box
Source: PassMark Software, www.osforensics.com
5. In the OSForensics Registry Viewer, click Search, Find from the menu to open the Find
dialog box. In the Search For text box, type Outlook.com (see Figure 5-30), and then
click the Find button.
6. In the Registry Viewer pane on the right, right-click the first search hit and click Add
to Case to open the Please Enter New Case Item Details dialog box. In the Title text
box, type Outlook e-mail address for Denise Robinson, and then click OK.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
226
Chapter 5
Figure 5-30 Entering a search term
Source: PassMark Software, www.osforensics.com
7. In the Find dialog box, click Find again. Right-click the next search hit and
click Add to Case. Type Outlook e-mail Web site in the Title text box,
and then click OK.
8. In the Find dialog box, click Find again. Right-click the next search hit and click Add
to Case. Type Denise Robinson’s e-mail address in the Title text box, and then click
OK. Exit Registry Viewer.
9. In the main OSForensics window, click Manage Case in the navigation bar on the left.
In the Manage Current Case pane on the right, click the Generate Report button. In
the Export Report window, click Browse next to the Output Location text box, navigate to your work folder, click OK, and then click OK again to open the report in your
Web browser. In the Mounted virtual disks window, click the Dismount button. Click
Yes, and then click Exit.
An extensive amount of information is stored in the Registry. With Registry data, you can ascertain when users went online, when they accessed a printer, and many other events. A lot
of the information in the Registry is beyond the scope of this book, so you’re encouraged to
expand your knowledge by attending training sessions or classes.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding Microsoft Startup Tasks
227
Understanding Microsoft Startup Tasks
You should have a good understanding of what happens to disk data at startup. In some
investigations, you must preserve data on the disk exactly as the suspect last used it. Any
access to a computer system after it was used for illicit purposes alters your disk evidence. As
you learned in Chapter 3, altering disk data lessens its evidentiary quality considerably. In
some instances, accessing a suspect computer incorrectly could make the digital evidence corrupt and less credible for litigation.
In the following sections, you learn what files are accessed when Windows starts. This information helps you determine when a suspect’s computer was last accessed, which is particularly important with computers that might have been used after an incident was reported.
Startup in Windows 7 and Windows 8
Since Windows Vista, Microsoft has changed its approach to OS boot processes. In addition,
Windows 8 is a multiplatform OS that can run on desktops, laptops, tablets, and smartphones. This discussion covers desktop and laptop computers running Windows 8, although
Windows Vista and 7 are very similar.
All Windows 8 boot processes are designed to run on multiple devices, ranging from desktop
or laptop systems to tablets and smartphones. In Windows Vista and later, the boot process
uses a boot configuration data (BCD) store. For desktops and laptops (BIOS-designed systems), a BCD Registry file in the nBootnBcd folder is maintained to control the boot process.
To access this file, you use the BCD Editor; Regedit and Regedt32 aren’t associated with this
file.
In Windows 8, the BCD contains the boot loader that initiates the system’s bootstrap process
when Windows starts. To access the Advanced Boot Options menu during the bootstrap
process, press F8 or F12 when the system is starting. This menu enables you to choose
between Safe Mode (or Enable Safe Mode, in Windows 8), Enable boot logging, or Disable
Driver Signature Enforcement.
To access the computer’s firmware to modify the boot priority order, press F2 or Delete.
Follow the onscreen instructions to save the updates and reboot the computer. For additional
information on Windows 8 boot processes, refer to Windows 8 Administration Pocket
Consultant (William R. Stanek, Microsoft Press, 2012, ISBN 978-0-7356-6613-9).
Startup in Windows NT and Later
Although Windows NT is much different from Windows 95 and 98, the startup method for
the NT OSs—NT, 2000, and XP—is about the same. There are some minor differences in
how certain system start files function, but they accomplish the same orderly startup.
Any computer using NTFS performs the following steps when the computer is turned on:
•
Power-on self test (POST)
•
Initial startup
•
Boot loader
•
Hardware detection and configuration
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
228
Chapter 5
•
Kernel loading
•
User logon
Windows OSs use the files discussed in the following sections to start. These files can be
located on the system partition or boot partition.
Startup Files for Windows Vista When Microsoft developed Vista, it updated
the boot process to use the new Extensible Firmware Interface (EFI) as well as the older BIOS
system. The EFI boot firmware is designed to provide better protection against malware than
BIOS does. EFI Vista’s boot processes have also changed since Windows XP. The Ntldr program in Windows XP used to load the OS has been replaced with these three boot utilities:
•
Bootmgr.exe—The Windows Boot Manager program controls boot flow and allows
booting multiple OSs, such as booting Vista along with XP.
•
Winload.exe—The Windows Vista OS loader installs the kernel and the Hardware
Abstraction Layer (HAL) and loads memory with the necessary boot drivers.
•
Winresume.exe—This tool restarts Vista after the OS goes into hibernation mode.
Windows Vista also includes the BCD editor for modifying boot options and updating the
BCD registry file. The BCD store replaces the Windows XP Boot.ini file. For additional
information on the BCD, see www.microsoft.com/whdc/system/platform/firmware/bcd.mspx.
Startup Files for Windows XP Unless otherwise specified, most startup files for
Windows XP are in the root folder of the system partition. NT Loader (Ntldr) loads the OS.
When the system is powered on, Ntldr reads the Boot.ini file, which displays a boot menu.
After you select the mode to boot to, Boot.ini runs Ntoskrnl.exe and reads
Bootvid.dll, Hal.dll, and startup device drivers. Boot.ini specifies the Windows XP
path installation and contains options for selecting the Windows version.
If a system has multiple boot OSs, including older ones such as Windows 9x or DOS, Ntldr
reads BootSect.dos (a hidden file), which contains the address (boot sector location) of each
OS.
When the boot selection is made, Ntldr runs NTDetect.com, a 16-bit real-mode program that
queries the system for device and configuration data, and then passes its findings to Ntldr. This
program identifies components and values on the computer system, such as the following:
•
CMOS time and date value
•
Buses attached to the motherboard, such as Industry Standard Architecture (ISA) or Peripheral Component Interconnect (PCI)
•
Disk drives connected to the system
•
Mouse input devices connected to the system
•
Parallel ports connected to the system
NTBootdd.sys is the device driver that allows the OS to communicate with SCSI or
ATA drives that aren’t related to the BIOS. (On some workstations, a SCSI disk is used
as the primary boot disk.) Controllers that don’t use Interrupt 13 (INT-13) use
NTBootdd.sys. It runs in privileged processor mode with direct access to hardware and
system data.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding Microsoft Startup Tasks
229
Ntoskrnl.exe is the Windows XP OS kernel, located in the %systemroot%
nWindowsnSystem32 folder.
Hal.dll is the Hardware Abstraction Layer (HAL) dynamic link library, located in the
%systemroot%nWindowsnSystem32 folder. The HAL allows the OS kernel to communicate
with the computer’s hardware.
At startup, data and instruction code are moved in and out of the Pagefile.sys file to optimize the amount of physical RAM available.
The HKEY_LOCAL_MACHINEnSYSTEM Registry key contains information the OS
requires to start system services and devices. This system Registry file is located in the
%systemroot%nWindowsnSystem32nConfignSystem folder.
Device drivers contain instructions for the OS for hardware devices, such as the keyboard, mouse,
and video card, and are stored in the %systemroot%nWindowsnSystem32nDrivers folder.
To identify the specific path for %systemroot% at a DOS prompt, type
set with no switches or parameters and press Enter. This command
displays all current %systemroot% paths.
Windows XP System Files Next, you need to examine the core OS files that Windows XP, 2000, and NT use, usually located in %systemroot%nWindowsnSystem32 or
%systemroot%nWinntnSystem32. Table 5-8 lists the system files Windows XP uses. Although
a few of these files are repeats of previous table entries, you should be aware of their key roles.
Table 5-8 Windows XP system files
Filename
Description
Ntoskrnl.exe
The XP executable and kernel
Ntkrnlpa.exe
The physical address support program for accessing more than 4 GB of
physical RAM
Hal.dll
The Hardware Abstraction Layer (described earlier)
Win32k.sys
The kernel-mode portion of the Win32 subsystem
Ntdll.dll
System service dispatch stubs to executable functions and internal support
functions
Kernel32.dll
Core Win32 subsystem DLL file
Advapi32.dll
Core Win32 subsystem DLL file
User32.dll
Core Win32 subsystem DLL file
Gdi32.dll
Core Win32 subsystem DLL file
ª 2016 Cengage Learningâ
Contamination Concerns with Windows XP When you start a Windows XP
NTFS workstation, several files are accessed immediately. When any of these or other related
OS files are accessed at startup, the last access date and time stamp for the files changes to the
current date and time. This change destroys any potential evidence that shows when a Windows XP workstation was last used. For this reason, you should have a strong working
knowledge of the startup process.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
230
Chapter 5
Understanding Virtual Machines
New versions of OSs and applications are released frequently, but older versions are still
widely used. As an investigator, you’ll face the challenge of having enough resources to support the variety of software you’re likely to encounter. More companies are turning to virtualization to reduce the cost of hardware purchases, so the number of investigations involving
virtual machines will increase as this practice continues.
As an investigator, you might need a virtual server to view legacy systems, and you might
need to forensically examine suspects’ virtual machines. Virtual machines enable you to
run another OS on an existing physical computer (known as the host computer) by emulating a computer’s hardware environment. Figure 5-31 shows an Oracle VM VirtualBox
virtual machine running Windows 8.1 on the desktop of a host computer. Typically, a
virtual machine consists of several files. The two main files are the configuration file containing hardware settings, such as RAM, network configurations, port settings, and so
on, and the virtual hard disk file, which contains the boot loader program, OS files, and
users’ data files. (Depending on the virtualization software, these files might be organized
differently.)
Figure 5-31 A virtual machine running on the host computer’s desktop
Source: Courtesy of Oracle VirtualBox
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding Virtual Machines
231
Another reason for using a virtual machine in an investigation is to emulate actions taken
by a suspect or even by malware. Several forensics analysis tools can convert a forensic
image to an ISO image or a virtual hard disk (VHD) file, which enables you to run a
suspect’s computer in a virtual environment. This feature is useful for analyzing malware
to see how it behaves without corrupting or contaminating your workstation.
A virtual machine acts like any other computer but with a twist: It performs all the tasks
the OS running on the physical computer can, up to a certain point. The virtual machine
recognizes hardware components of the host computer it’s loaded on, such as the mouse,
keyboard, and CD/DVD drive. However, the guest OS (the one running on a virtual
machine) is limited by the host computer’s OS, which might block certain operations. For
example, most virtual machines recognize a CD/DVD drive because the host computer
defaults to autodetect. Some virtual machines don’t recognize a USB drive; this capability
varies with the virtualization software. Although networking capabilities are beyond the scope
of this book, be aware that virtual machines can use bridged, Network Address Translation
(NAT), or other network configurations to determine how they access the Internet and communicate with systems on the local network.
Say your company has upgraded to Windows 8, but you still have a few applications that
require Windows XP. Not a problem! Choose your virtualization software, install the
Windows XP OS and the applications you want to run, and you’re ready to go. Depending on
the host computer’s hard drive size and amount of RAM, you can have an entire virtual network running on one physical computer. One advantage is that if you’re running several virtual
machines, you can pause some of the guest OSs to keep them from consuming CPU cycles and
then resume them when needed.
In digital forensics, virtual machines make it possible to restore a suspect drive on a virtual
machine and run nonstandard software the suspect might have loaded, for example. You can
browse through the drive’s contents, and then go back to the forensic image and test the items
you found. Remember that in forensics, everything should be reproducible. Therefore, anything you found in the virtual machine re-creation of the suspect drive should exist in the forensic image, too.
From a network forensics standpoint, you need to be aware of some potential issues, such as
a virtual machine used to attack another system or network. The technology is still developing, so it’s unclear how much of the physical drive is represented in the virtual disk file. File
slack, unallocated space, and so forth don’t exist on a virtual machine, so many standard
items don’t work on virtual drives.
Creating a Virtual Machine
Some common applications for creating virtual machines are VMware Server, VMware
Player and VMware Workstation, Oracle VM VirtualBox, Microsoft Virtual PC, and HyperV, available in current versions of Windows Server. VirtualBox is an open-source program
that can be downloaded at www.virtualbox.org/wiki/Downloads.
The Microsoft Academic Alliance issues ISO images to schools and
students for an inexpensive annual fee.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
232
Chapter 5
Consult with your instructor before doing the following activity, which shows you how to
create a virtual machine in VirtualBox. Follow these steps:
1. If you haven’t already done so, download and install VirtualBox.
2. In Windows 8 or later, go to the Start screen, type VirtualBox, and press Enter.
3. In the Oracle VM VirtualBox Manager, click the New icon at the upper left (see Figure
5-32) to start the Create Virtual Machine Wizard.
Figure 5-32 The Oracle VM VirtualBox Manager
Source: Courtesy of Oracle VirtualBox
4. In the Name and operating system window, type Windows 7 GCFI for the
virtual machine name (see Figure 5-33). If necessary, click the Type list arrow,
and click Microsoft Windows; then click the Version list arrow, and click
Windows 7 (32-bit if you have Windows 7 x86 or 64-bit if you have x64).
Click Next.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding Virtual Machines
233
5
Figure 5-33 Entering a virtual machine name
Source: Courtesy of Oracle VirtualBox
5. In the Memory size window, adjust the allocated memory to about 50% of your workstation’s total amount of RAM, and then click Next.
6. In the Hard drive window, click Create a virtual drive now, and then click Create.
7. In the Hard drive file type window, click VHD (Virtual Hard Disk), and then click
Next.
VirtualBox offers versatility in its virtual hard disk file options. By selecting the VHD option, you can load the virtual hard disk file into other
virtualization programs, such as VMware.
8. In the Storage on physical hard drive window, click Dynamically allocated, and then
click Next.
9. In the File location and size window, expand the default of 25 GB if you think you
need more storage space allocated, and then click Create. When VirtualBox finishes
creating the virtual machine, the window shown in Figure 5-34 is displayed. Leave
VirtualBox running for the next activity.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
234
Chapter 5
Figure 5-34 Displaying a created virtual machine
Source: Courtesy of Oracle VirtualBox
In the following activity, you use an ISO image that your instructor will provide on the
network or a CD for installing Windows 7 as a guest OS. (You can also install other
Windows OSs and most Linux distributions as guest OSs.) For any guest OS, you must
have a valid product key to install it. You can get the product key from your
instructor.
1. In the Oracle VM VirtualBox Manager, click the Settings icon. In the Windows 7 Settings dialog box, click System in the left pane, and click to clear the Floppy
check box for the boot order (leaving the CD/DVD and Hard Disk check boxes
selected).
2. Next, click Display in the left pane, and click the Video tab, if necessary. Adjust the
Video Memory slider to at least 27 MB (see Figure 5-35).
Depending on the amount of video memory on your workstation, you
might need to adjust it so that your monitor can display the virtual session correctly. For more information on this setting and other VirtualBox features, see www.virtualbox.org/wiki/Documentation.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding Virtual Machines
235
5
Figure 5-35 Adjusting the video memory
Source: Courtesy of Oracle VirtualBox
3. Click Storage in the left pane, click Empty in the Storage Tree section, and then click
the down arrow with the disk icon, as shown in Figure 5-36. If you have a Windows
ISO file, click Choose a virtual CD/DVD disk file, click an ISO image to install, and
then click OK. If you have a Windows installation DVD, click Host Drive ‘E:’, and
then click OK. In the Oracle VM VirtualBox Manager, click Start.
Figure 5-36 Selecting a source drive
Source: Courtesy of Oracle VirtualBox
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
236
Chapter 5
In this example, the installation disc for the source OS, Windows 7, is
in the DVD drive, lettered E. Your workstation might show a different
drive letter, such as D:, if your hard drive has only one partition.
4. Follow the prompts to continue installing Windows 7 as a guest OS on your virtual
machine. If the “Which type of installation do you want?” window is displayed, click
Custom (advanced), as shown in Figure 5-37.
Figure 5-37 Selecting a Windows installation option
Source: Courtesy of Oracle VirtualBox
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Chapter Summary
237
To start a virtual session in VirtualBox, select a virtual machine you created, and then click
the Start icon (see Figure 5-38). You see standard boot prompts for the logon name and password you defined during the OS installation. The guest OS works as though it were running
on a stand-alone workstation. You can add other applications to this virtual environment to
perform tasks as needed. To terminate the session, simply perform the usual Windows shutdown procedure.
Select the virtual machine by clicking here
5
Figure 5-38 Starting a virtual machine session
Source: Courtesy of Oracle VirtualBox
Be aware that as you install software and perform other tasks, you might encounter problems
with recognition of the CD/DVD drive, for example. Virtual machines present some challenges because they are limited by the host computer they’re loaded on. For this reason, many
legal issues need to be addressed before these systems are accepted for use in court.
Chapter Summary
䊏
When booting a suspect’s computer, using boot media, such as forensic boot CDs or
USB drives, is important to ensure that disk evidence isn’t altered. You should access
a suspect computer’s BIOS to configure the computer to boot to these CDs or USB
drives.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
238
Chapter 5
䊏
The Master Boot Record (MBR) stores information about partitions on a disk.
䊏
Microsoft used FAT12 and FAT16 on older operating systems, such as MS-DOS,
Windows 3.x, and Windows 9x. The maximum partition size is 2 GB. Newer systems
use FAT32. FAT12 is now used mainly on floppy disks and small USB drives. VFAT,
created for Windows 95, allows filenames longer than eight characters.
䊏
To find a hard disk’s capacity, use the cylinders, heads, and sectors (CHS) calculation.
To find a disk’s byte capacity, multiply the number of heads, cylinders, and sectors.
䊏
Sectors are grouped into clusters and clusters are chained because the OS can track only a
given number of allocation units (65,536 in FAT16 and 4,294,967,296 in FAT32).
䊏
Solid-state disk drives use wear-leveling to ensure even use of memory cells. It transfers
data to unused memory cells so that all cells have an equal amount of reads and writes.
The previously assigned memory cells are listed as unallocated space. After a predetermined time, the unallocated memory cells are overwritten with binary 1s.
䊏
When files are deleted in a FAT file system, the hexadecimal value 0x05 is inserted in
the first character of the filename in the directory.
䊏
NTFS is more versatile because it uses the Master File Table (MFT) to track file information. Approximately the first 512 bytes of data for small files (called resident files)
are stored in the MFT. Data for larger files (called nonresident files) is stored outside
the MFT and linked by using cluster addresses.
䊏
Records in the MFT contain attribute IDs that store metadata about files.
䊏
In NTFS, alternate data streams can obscure information that might be of evidentiary
value to an investigation.
䊏
File slack, RAM slack (in older Windows OSs), and drive slack are areas in which valuable information, such as downloaded files, swap files, passwords, and logon IDs, can
reside on a drive.
䊏
NTFS can encrypt data with Encrypting File System (EFS) and BitLocker. Decrypting data
with these methods requires using recovery certificates. BitLocker is Microsoft’s whole disk
encryption (WDE) utility that can be decrypted by using a one-time passphrase.
䊏
The Resilient File System (ReFS), available only in Windows 8 and Windows Server
2012, provides access to large disk storage systems.
䊏
With a hexadecimal editor, you can determine information such as file type and OS
configurations.
䊏
NTFS can compress files, folders, or an entire volume. FAT16 can compress only entire
volumes.
䊏
The Registry in Windows keeps a record of attached hardware, user preferences, network connections, and installed software. It also contains information such as passwords in two binary files: System.dat and User.dat.
䊏
Every user with an account on a Windows computer has his or her own Ntuser.dat
file. Windows 9x user information is stored in User.dat.
䊏
Virtualization software enables you to run other OSs on a host computer. Virtual
machines are beneficial if, for example, you need to run a previous OS to test old software that won’t run on newer OSs.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Key Terms
239
Key Terms
alternate data streams Ways in which data can be appended to a file (intentionally or not)
and potentially obscure evidentiary data. In NTFS, alternate data streams become an
additional file attribute.
American Standard Code for Information Interchange (ASCII) An 8-bit coding scheme that
assigns numeric values to up to 256 characters, including letters, numerals, punctuation
marks, control characters, and other symbols.
areal density The number of bits per square inch of a disk platter.
attribute ID In NTFS, an MFT record field containing metadata about the file or folder and
the file’s data or links to the file’s data.
Boot.ini A file that specifies the Windows path installation and a variety of other startup
options.
BootSect.dos If a machine has multiple booting OSs, NTLDR reads BootSect.dos,
which is a hidden file, to determine the address (boot sector location) of each OS. See also
NT Loader (Ntldr).
bootstrap process Information contained in ROM that a computer accesses during startup;
this information tells the computer how to access the OS and hard drive.
clusters Storage allocation units composed of groups of sectors. Clusters are 512, 1024,
2048, or 4096 bytes each.
cylinder A column of tracks on two or more disk platters.
data runs Cluster addresses where files are stored on a drive’s partition outside the MFT
record. Data runs are used for nonresident MFT file records. A data run record field consists
of three components; the first component defines the size in bytes needed to store the second
and third components’ content.
device drivers Files containing instructions for the OS for hardware devices, such as the
keyboard, mouse, and video card.
drive slack Unused space in a cluster between the end of an active file and the end of the
cluster. It can contain deleted files, deleted e-mail, or file fragments. Drive slack is made up of
both file slack and RAM slack. See also file slack and RAM slack.
Encrypting File System (EFS) A public/private key encryption first used in Windows 2000 on
NTFS-formatted disks. The file is encrypted with a symmetric key, and then a public/private
key is used to encrypt the symmetric key.
File Allocation Table (FAT) The original Microsoft file structure database. It’s written to the
outermost track of a disk and contains information about each file stored on the drive. PCs
use the FAT to organize files on a disk so that the OS can find the files it needs. The
variations are FAT12, FAT16, FAT32, VFAT, and FATX.
file slack The unused space created when a file is saved. If the allocated space is larger than
the file, the remaining space is slack space and can contain passwords, logon IDs, file
fragments, and deleted e-mails.
file system The way files are stored on a disk; gives an OS a road map to data on a disk.
geometry A disk drive’s internal organization of platters, tracks, and sectors.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
240
Chapter 5
Hal.dll The Hardware Abstraction Layer dynamic link library allows the OS kernel to
communicate with hardware.
head The device that reads and writes data to a disk drive.
head and cylinder skew A method manufacturers use to minimize lag time. The starting
sectors of tracks are slightly offset from each other to move the read-write head.
High Performance File System (HPFS) The file system IBM uses for its OS/2 operating system.
Info2 file In Windows NT through Vista, the control file for the Recycle Bin. It contains
ASCII data, Unicode data, and date and time of deletion.
ISO image A bootable file that can be copied to CD or DVD; typically used for installing
operating systems. It can also be read by virtualization software when creating a virtual boot disk.
logical addresses When files are saved, they are assigned to clusters, which the OS numbers
sequentially starting at 2. Logical addresses point to relative cluster positions, using these
assigned cluster numbers.
logical cluster numbers (LCNs) The numbers sequentially assigned to each cluster when an
NTFS disk partition is created and formatted. The first cluster on an NTFS partition starts at
count 0. LCNs become the addresses that allow the MFT to read and write data to the disk’s
nonresident attribute area. See also data runs and virtual cluster number (VCN).
Master Boot Record (MBR) On Windows and DOS computers, this boot disk file contains
information about partitions on a disk and their locations, size, and other important items.
Master File Table (MFT) NTFS uses this database to store and link to files. It contains
information about access rights, date and time stamps, system attributes, and other
information about files.
metadata In NTFS, this term refers to information stored in the MFT. See also Master File
Table (MFT).
NTBootdd.sys A device driver that allows the OS to communicate with SCSI or ATA
drives that aren’t related to the BIOS.
NTDetect.com A 16-bit program that identifies hardware components during startup and
sends the information to Ntldr.
NT File System (NTFS) The file system Microsoft created to replace FAT. NTFS uses security
features, allows smaller cluster sizes, and uses Unicode, which makes it a more versatile
system. NTFS is used mainly on newer OSs, starting with Windows NT.
NT Loader (Ntldr) A program located in the root folder of the system partition that loads the
OS. See also BootSect.dos.
Ntoskrnl.exe The kernel for the Windows NT family of OSs.
one-time passphrase A password used to access special accounts or programs requiring a
high level of security, such as a decryption utility for an encrypted drive. This passphrase can
be used only once, and then it expires.
Pagefile.sys At startup, data and instruction code are moved in and out of this file to
optimize the amount of physical RAM available during startup.
partition A logical drive on a disk. It can be the entire disk or part of the disk.
Partition Boot Sector The first data set of an NTFS disk. It starts at sector [0] of the disk
drive and can expand up to 16 sectors.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Key Terms
241
partition gap Unused space or void between the primary partition and the first logical partition.
personal identity information (PII) Any information that can be used to create bank or credit
card accounts, such as name, home address, Social Security number, and driver’s license number.
physical addresses The actual sectors in which files are located. Sectors reside at the
hardware and firmware level.
private key In encryption, the key used to decrypt the file. The file owner keeps the private key.
public key In encryption, the key used to encrypt a file; it’s held by a certificate authority,
such as a global registry, network server, or company such as VeriSign.
RAM slack The unused space between the end of the file (EOF) and the end of the last sector
used by the active file in the cluster. Any data residing in RAM at the time the file is saved,
such as logon IDs and passwords, can appear in this area, whether the information was
saved or not. RAM slack is found mainly in older Microsoft OSs.
recovery certificate A method NTFS uses so that a network administrator can recover
encrypted files if the file’s user/creator loses the private key encryption code.
Registry A Windows database containing information about hardware and software
configurations, network connections, user preferences, setup information, and other critical
information.
Resilient File System (ReFS) A new file system developed for Windows Server 2012. It allows
increased scalability for disk storage and improved features for data recovery and error checking.
sector A section on a track, typically made up of 512 bytes.
track density The space between tracks on a disk. The smaller the space between tracks,
the more tracks on a disk. Older drives with wider track densities allowed the heads to
wander.
tracks Concentric circles on a disk platter where data is stored.
unallocated disk space Partition disk space that isn’t allocated to a file. This space might
contain data from files that have been deleted previously.
Unicode A character code representation that’s replacing ASCII. It’s capable of representing
more than 64,000 characters and non-European-based languages.
UTF-8 (Unicode Transformation Format) One of three formats Unicode uses to translate
languages for digital representation.
virtual cluster number (VCN) When a large file is saved in NTFS, it’s assigned a logical cluster
number specifying a location on the partition. Large files are referred to as nonresident files. If
the disk is highly fragmented, VCNs are assigned and list the additional space needed to store
the file. The LCN is a physical location on the NTFS partition; VCNs are the offset from the
previous LCN data run. See also data runs and logical cluster numbers (LCNs).
virtual hard disk (VHD) A file representing a system’s hard drive that can be booted in a
virtualization application and allows running a suspect’s computer in a virtual
environment.
virtual machines Emulated computer environments that simulate hardware and can be used
for running OSs separate from the physical (host) computer. For example, a computer
running Windows Vista could have a virtual Windows 98 OS, allowing the user to switch
between OSs.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
242
Chapter 5
wear-leveling An internal firmware feature used in solid-state drives that ensures even wear
of read/writes for all memory cells.
zone bit recording (ZBR) The method most manufacturers use to deal with a platter’s inner
tracks being shorter than the outer tracks. Grouping tracks by zones ensures that all tracks
hold the same amount of data.
Review Questions
1. On a Windows system, sectors typically contain how many bytes?
a. 256
b.
512
c.
1024
d.
2048
2. What does CHS stand for?
3. Zone bit recording is how disk manufacturers ensure that a platter’s outer tracks store as
much data as possible. True or False?
4. Areal density refers to which of the following?
a. Number of bits per disk
b.
Number of bits per partition
c.
Number of bits per square inch of a disk platter
d.
Number of bits per platter
5. Clusters in Windows always begin numbering at what number?
6. How many sectors are typically in a cluster on a disk drive?
a. 1
b.
2 or more
c.
4 or more
d.
8 or more
7. List three items stored in the FAT database.
8. What does the Ntuser.dat file contain?
9. In FAT32, a 123 KB file uses how many sectors?
10. What is the space on a drive called when a file is deleted? (Choose all that apply.)
a. Disk space
b.
Unallocated space
c.
Drive space
d.
Free space
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Review Questions
243
11. List two features NTFS has that FAT does not.
12. What does MFT stand for?
13. In NTFS, files smaller than 512 bytes are stored in the MFT. True or False?
14. In Windows 7 and later, how much data from RAM is loaded into RAM slack on a disk drive?
15. What’s a virtual cluster number?
16. Why was EFI boot firmware developed?
17. Device drivers contain what kind of information?
18. Which of the following Windows 8 files contains user-specific information?
a. User.dat
b.
Ntuser.dat
c.
System.dat
d.
SAM.dat
19. Virtual machines have which of the following limitations when running on a host computer?
a. Internet connectivity is restricted to virtual Web sites.
b.
Applications can be run on the virtual machine only if they’re resident on the physical machine.
c.
Virtual machines are limited to the host computer’s peripheral configurations, such
as mouse, keyboard, CD/DVD drives, and other devices.
d.
Virtual machines can run only OSs that are older than the physical machine’s OS.
20. An image of a suspect drive can be loaded on a virtual machine. True or False?
21. EFS can encrypt which of the following?
a. Files, folders, and volumes
b.
Certificates and private keys
c.
The global Registry
d.
Network servers
22. What happens when you copy an encrypted file from an EFS-enabled NTFS disk to a
non-EFS disk or folder?
a. The file can no longer be encrypted.
b.
EFS protection is maintained on the file.
c.
The file is unencrypted automatically.
d.
Only the owner of the file can continue to access it.
23. What are the functions of a data run’s field components in an MFT record?
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
244
Chapter 5
Hands-On Projects
There are no data files to extract for this chapter’s projects, but create a
Work\Chap05nProjects folder on your system before starting the projects.
Hands-On Project 5-1
In this project, you compare two files created in Microsoft Office to determine
whether the files are different at the hexadecimal level. Keep a log of what you
find. Follow these steps:
1. Start Word, and in a new document, type This is a test.
2. Save the file as Mywordnew.doc in your work folder, using Word 972003 Document (*.doc) as the file type. Exit Word.
3. Start Excel, and in a new workbook, enter a few random numbers. Save
the file in your work folder as Myworkbook.xls, using Excel 97 - 2003
Workbook (*.xls) as the file type.
4. Exit Excel, and start WinHex (running it as an Administrator).
5. Click File, Open from the menu. In the Open dialog box, navigate to your
work folder and double-click Mywordnew.doc.
6. Notice the file hexadecimal header D0 CF 11 E0 Al Bl 1A El starting at offset
0. Click Edit, Copy All from the menu, and then click Editor Display.
7. Start Notepad, and in a new document, press Ctrl+V to paste the copied
data. Leave this window open.
8. Click File, Open from the WinHex menu. In the Open dialog box, navigate to your work folder and double-click Myworkbook.xls.
9. Repeat Step 6.
10. Paste the data you just copied under the Word document header information you pasted previously.
11. In the Notepad window, add your observations about the two files’ header
data. Save this file as C5Prj01.txt and turn it in to your instructor.
12. Exit WinHex.
Hands-On Project 5-2
In this project, you explore the MFT and learn how to locate date and time
values in the metadata of a file you create. These steps help you identify previously deleted fragments of MFT records that you might find in unallocated
disk space or in residual data in Pagefile.sys. You need the following for
this project:
• A system running Windows Vista or later, with the C drive formatted as
NTFS
• Notepad to create a small text file
• WinHex to analyze the metadata in the MFT (available on the book’s DVD)
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
245
1. Start Notepad, and create a text file with one or more of the following
lines:
• A countryman between two lawyers is like a fish between two cats.
• A slip of the foot you may soon recover, but a slip of the tongue you
may never get over.
• An investment in knowledge always pays the best interest.
• Drive thy business or it will drive thee.
2. Save the file in your work folder as C5Prj02.txt, and exit Notepad. (If
your work folder isn’t on the C drive, make sure you save the file on your
C drive to have it entered in the $MFT files you copy later.)
3. Next, review the material in “MFT and File Attributes,” paying particular
attention to attributes 0x10 and 0x30 for file dates and times. The following charts show the offset byte count starting at position FILE of the file’s
MFT record for the date and time stamps:
The offsets listed in the following charts are from the first byte of the
MFT record, not the starting position of the specific attributes 0x10
and 0x30.
0x10 $Standard Information (data starts at offset 0x18)
Description of field
Offset position
Byte size
C Time (file creation)
0x50
8
A Time (file altered)
0x58
8
L Time (Last accessed)
0x60
8
ª 2016 Cengage Learningâ
0x30 $File Name (data starts at offset 0x18)
Description of field
Offset position
Byte size
C Time (file creation)
0xB8
8
A Time (file altered)
0xC0
8
R Time (file read)
0xC8
8
M Time (MFT change)
0xD0
8
ª 2016 Cengage Learningâ
Next, you examine the metadata of the C5Prj02.txt file stored in the $MFT
file. Follow these steps:
1. Start WinHex with the Run as administrator option. If you see an evaluation warning message, click OK.
2. As a safety precaution, click Options, Edit Mode from the menu. In the
Select Mode (globally) dialog box, click Read-only Mode (¼write
protected), as shown in Figure 5-39, and then click OK.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
246
Chapter 5
Figure 5-39 Changing WinHex to read-only mode
Courtesy of X-Ways AG, www.x-ways.net
WinHex defaults to an editable mode, which means you can alter data
in important system files and possibly corrupt them. When using a
disk editor such as WinHex, always set it to read-only mode, unless
you need to make specific modifications to data.
3. Click Tools, Open Disk from the menu. In the View Disk dialog box,
click the C: drive (or the drive where you saved C5Prj02.txt), as
shown in Figure 5-40, and then click OK. If you’re prompted to take
a new snapshot, click Take new one. Depending on the size and
quantity of data on your disk, it might take several minutes for
WinHex to traverse all the files and paths on your disk drive.
Figure 5-40 Selecting the drive in WinHex
Courtesy of X-Ways AG, www.x-ways.net
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
247
By default, WinHex displays a floating Data Interpreter window that
converts hex values to decimal values and can also convert date and
time codes. If you don’t see this window, activate it by clicking View,
pointing to Show, and clicking Data Interpreter.
4. Click Options, Data Interpreter from the menu. In the Data Interpreter
Options dialog box, click the Win32 FILETIME (64 bit) check box,
shown in Figure 5-41, and then click OK. The Data Interpreter should
then have FILETIME as an additional display item.
5
Figure 5-41 The Data Interpreter Options dialog box
Courtesy of X-Ways AG, www.x-ways.net
5. Now you need to navigate to your work folder (C:nWorknChap05nProjects)
in WinHex. In the upper-right pane of WinHex, scroll down until you see
your work folder. Double-click each folder in the path (see Figure 5-42),
and then click the C5Prj02.txt file.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
248
Chapter 5
Figure 5-42 Navigating through folders in WinHex
Courtesy of X-Ways AG, www.x-ways.net
6. Click at the beginning of the record, on the letter F in FILE, and then drag
down and to the right while you monitor the hexadecimal counter in
the lower-right corner. (Note: 50 hexadecimal bytes is the “offset
position” for the first date and time stamp for this record, as described
in the previous charts for 0x10 $Standard Information.) When the
counter reaches 50 (see Figure 5-43), release the mouse button.
Offset counter
Note date and time
Click here and drag down until offset
counter shows 50 bytes
After dragging, release mouse button and click here to interpret date and time
Figure 5-43 Locating the date and time value in the MFT record
Courtesy of X-Ways AG, www.x-ways.net
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
249
7. Move the cursor one position to the next byte (down one line and to the
left), and record the date and time of the Data Interpreter’s FILETIME
values.
8. Reposition the mouse cursor on the remaining offsets listed in the previous
charts, and record their values.
9. When you’re finished, exit WinHex and hand in the date and time values
you recorded.
Hands-On Project 5-3
In this project, you use WinHex to become familiar with different file types.
Follow these steps:
1. Locate or create Microsoft Excel (.xls), Microsoft Word (.doc), .gif,
.jpg, and .mp3 files. If you’re creating a Word document or an Excel
spreadsheet, save it as an Office 97-2003 file.
2. Start WinHex.
3. Open each file type in WinHex. Record the hexadecimal codes for each file
in a text editor, such as Notepad or WordPad. For example, for the Word
document, record Word Header: D0 CF 11 E0.
4. Save the file, and then print it to give to your instructor.
Hands-On Project 5-4
This project is a continuation of the in-chapter activity done with OSForensics.
The paralegal has asked you to see whether any passwords are listed in the
image of Denise Robinson’s computer. Follow these steps:
1. Start OSForensics. If prompted to allow the program to make changes to
your computer, click OK or Yes. In the OSForensics message box, click
Continue Using Free Version.
2. Mount the InCh05.img file as described in the in-chapter activity.
3. In the main window, click Manage Case in the navigation bar on the left,
if necessary. In the Select Case pane on the right, double-click InChap05 if
a green checkmark isn’t displayed next to it.
4. In the navigation bar on the left, click Passwords. In the pane on the right,
click the Find Browser Passwords tab, if necessary. Click the Scan Drive
button, and then click the drive letter for the InCh05.img mounted
virtual drive.
5. In the navigation bar on the left, click Retrieve Passwords. In the pane on the
right, right-click the first item and click Export List to Case. In the Title text
box, type Denise Robinson’s additional e-mail and password, and then click
OK. Repeat this step for all browser passwords that were recovered.
6. In the Passwords window, click the Windows Login Passwords tab. Click
the Scan Drive button, and then click the drive letter for the InCh05.img
mounted virtual drive.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
5
250
Chapter 5
7. Click Retrieve Hashes, and then click Save to File. In the Save to dialog
box, navigate to your work folder, type Denise-Robinson-Win-PasswordsHashes in the File name text box, and then click Save.
8. In the navigation bar on the left, click Manage Case. In the Manage Current Case pane on the right, click the Add Attachment button. Navigate to
where you saved the Denise-Robinson-Win-Password file, click the file,
and click Open. In the Export Title text box, type Denise-RobinsonWin-Passwords, and then click Add.
9. In the navigation bar at the top, click Generate Report. In the Export
Report dialog box, click OK. If you get a warning message that the report
already exists, click Yes to overwrite the previous report.
10. Exit OSForensics, and print the report displayed in your Web browser.
Turn the report in to your instructor.
Case Projects
Case Project 5-1
Using the information you gathered in Hands-On Project 5-4, write a one-page
memo to the paralegal, Ms. D. K. Jones, explaining the process you used to
find the e-mail and password data.
Case Project 5-2
An employee suspects that his password has been compromised. He changed it
two days ago, yet it seems someone has used it again. What might be going
on?
Case Project 5-3
To continue your learning in digital forensics, you should research new
tools and methods often. For this project, download the user manuals for
VirtualBox and ProDiscover. Write a guide on how to load a VHD file converted from a ProDiscover .eve image file into VirtualBox. You can download the user guide for VirtualBox at www.virtualbox.org/wiki/Downloads.
The ProDiscover manual should be in the following path, under the folder
where you installed ProDiscover: Program Files (x86)nTechnology Pathwaysn
ProDiscovernProDiscoverManual.pdf.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
chapter
6
Current Digital
Forensics Tools
After reading this chapter and completing
the exercises, you will be able to:
• Explain how to evaluate needs for digital forensics tools
• Describe available digital forensics software tools
• List some considerations for digital forensics hardware tools
• Describe methods for validating and testing forensics tools
251
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
252
Chapter 6
Chapter 2 outlined how to set up a forensics laboratory. This chapter explores many
software and hardware tools used during digital forensics investigations. No specific tools are
recommended; instead, the goal is to explain how to select tools for digital investigations
based on specific criteria.
Forensics tools are constantly being developed, updated, patched, revised, and discontinued.
Therefore, checking vendors’ Web sites routinely to look for new features and improvements
is important. These improvements might address a difficult problem you’re having in an
investigation.
Before purchasing any forensics tools, consider whether the tool can save you time during
investigations and whether that time savings affects the reliability of data you recover. Many
GUI forensics tools require a lot of resources and demand computers with more memory and
faster processor speeds or more processors. Sometimes they require more resources than a
typical workstation has because of other applications, such as antivirus programs, running in
the background. These background programs compete for resources with a digital forensics
program, and a forensics program or the OS can stop running or hang, causing delays in
your investigation.
Finally, when planning purchases for your forensics lab, determine what a new forensics tool
can do better than one you’re currently using. In particular, assess how well the software
performs in validation tests, and then verify the integrity of the tool’s results.
As software continues to develop and investigators have new needs,
vendors will address these needs. The tools listed in this chapter are
in no way a complete list of tools available for Windows, Linux, or
Mac OS.
Evaluating Digital Forensics Tool Needs
As described in Chapter 2, you need to develop a business plan to justify the acquisition of
digital forensics hardware and software. When researching options, consider open-source
tools, which sometimes include technical support. The goal is to find the best value for as
many features as possible. Some questions to ask when evaluating tools include the
following:
•
On which OS does the forensics tool run? Does the tool run on multiple OSs?
•
Is the tool versatile? For example, does it work in both Windows and Linux?
•
Can the tool analyze more than one file system, such as FAT, NTFS, and Ext4?
•
Can a scripting language be used with the tool to automate repetitive functions and
tasks?
•
Does the tool have any automated features that can help reduce the time needed to
analyze data?
•
What is the vendor’s reputation for providing product support? For open-source tools,
how good are the support forums?
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Evaluating Digital Forensics Tool Needs
253
As you learn more about digital investigations, you’ll have more questions about tools for
conducting these investigations. When you search for tools, keep in mind what OSs and file
types you’ll be analyzing. For example, if you need to analyze Microsoft Access or SQL
Server databases, look for a product designed to read these files. If you’re analyzing e-mail
messages, look for a forensics tool that specializes in reading e-mail content.
When you’re selecting tools for your lab, keep an open mind, and compare platforms and
applications for different tasks. Although many investigators are most comfortable using
Windows tools, check into other options, such as Linux and Macintosh platforms.
Types of Digital Forensics Tools
Digital forensics tools are divided into two major categories: hardware and software. Each
category has subcategories discussed in more depth later in this chapter. The following
sections outline basic features required and expected of most digital forensics tools.
Hardware Forensics Tools Hardware forensics tools range from simple, singlepurpose components to complete computer systems and servers. For example, the Tableau
T35es-R2 SATA/IDE eSATA bridge is a single-purpose component that makes it possible to
access a SATA or an IDE drive with one device. Some examples of complete systems are Digital
Intelligence F.R.E.D. systems (www.digitalintelligence.com/cart/ComputerForensicsProducts/
Hardware-p1.html), DIBS Advanced Forensic Workstations (www.dibsforensics.com/index.
html), Forensic Computers’ Forensic Examination Stations and portable units (www.
forensic-computers.com), and H-11 Digital Forensics systems (www.h11dfs.com/products/
products/forensic-hardware/).
Software Forensics Tools Software forensics tools are grouped into command-line
applications and GUI applications. Some tools are specialized to perform one task. For example, SafeBack was designed as a command-line disk acquisition tool from New Technologies,
Inc. (NTI). It’s no longer supported, but you can still find it distributed online. However, it’s
used more as a reliable fallback when all else fails than a primary tool. Other tools are
designed to perform many different tasks. For example, PassMark Software OSForensics,
Technology Pathways ProDiscover, X-Ways Forensics, Guidance Software EnCase, and
AccessData FTK are GUI tools designed to perform most forensics acquisition and analysis
functions.
Software forensics tools are commonly used to copy data from a suspect’s drive to an image
file. Many GUI acquisition tools can read all structures in an image file as though the
image were the original drive and have the capability to analyze image files. In Chapter 5,
you learned how some of these tools are used to acquire data from suspects’ drives.
Tasks Performed by Digital Forensics Tools
All digital forensics tools, both hardware and software, perform specific functions. When
you’re testing new tools, you might find it helpful to follow guidelines set up by NIST’s
Computer Forensics Tool Testing (CFTT) program, ASTM International’s (formerly the
American Society of Testing and Materials) E2678 standard, and the International Organization
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
6
254
Chapter 6
on Computer Evidence (IOCE). In addition, ISO standard 27037 states that Digital Evidence
First Responders (DEFRs) should use validated tools. The following categories of functions are
meant as guidelines for evaluating digital forensics tools, with subfunctions for refining data
analysis and recovery and ensuring data quality:
•
Acquisition
•
Validation and verification
•
Extraction
•
Reconstruction
•
Reporting
NIST’s CFTT and other groups include additonal functions, such as data acquistion, data
extraction from mobile devices, file reconstruction, and string searching, that aren’t included
in these guidelines (“Verification of Digital Forensics Tools”, Jim Lyle, May 2010, Montana
Supreme Court Spring Training Conference). In the following sections, you learn how these
functions and subfunctions apply to digital investigations.
Acquisition Acquisition, the first task in digital forensics investigations, is making a copy
of the original drive. As described in Chapter 3, this procedure preserves the original drive
to make sure it doesn’t become corrupt and damage the digital evidence. In Chapter 4, you
learned how to handle digital evidence correctly, and in Chapter 8, you learn more about
using acquisition tools. Subfunctions in the acquisition category include the following:
•
Physical data copy
•
Logical data copy
•
Data acquisition format
•
Command-line acquisition
•
GUI acquisition
•
Remote, live, and memory acquisitions
ISO standard 27037 states that the most important factors in data acquisition are the
DEFR’s competency and the use of validated tools, and it includes guidelines on how to
approach acquisition in different situations. What’s most important is documenting what
was done and why. For example, if you’re acquiring data at a scene with hazardous materials, clearly speed is critical, so you might decide to forgo acquiring RAM and focus on collecting devices. You can also find decision-marking flowcharts on whether to copy an entire
physical disk or concentrate on only a partition or folder, for instance. Section 7 of the
standard addresses acquiring volatile memory, an important part of live acquisitions. Other
situations that affect acquisitions include encrypted devices or mission-critical systems that
can’t be turned off.
Some digital forensics software suites, such as AccessData FTK, have separate tools for
acquiring an image. However, some investigators opt to use hardware devices, such as
Tableau TD2, Logicube Talon, VOOM HardCopy 3P, or Image MASSter Solo-4 Forensic
unit from Intelligent Computer Solutions, Inc., for acquiring an image. These hardware
devices have built-in software for data acquisition. No other device or program is needed to
make a duplicate drive; however, you still need forensics software to analyze the data.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Evaluating Digital Forensics Tool Needs
255
To see specifications for the Logicube Talon, go to www.logicube.com/
shop/talon-enhanced/. To see the Image MASSter Solo-4 unit,
search at www.ics-iq.com. To see VOOM HardCopy 3, search at
www.voomtech.com.
Other acquisition tools require combining hardware devices and software programs to make
disk acquisitions. For example, many software tools mount drives as read-only, and others
might require a physical write-blocker. Any tool that has a built-in software write-blocker
should be verified to make sure evidence hasn’t been altered.
Two types of data-copying methods are used in software acquisitions: physical copying
of the entire drive and logical copying of a disk partition. Most software acquisition tools
include the option of imaging an entire physical drive or just a logical partition. Usually,
the situation dictates whether you make a physical or logical acquisition. One reason to
choose a logical acquisition is drive encryption. With the increasing emphasis on data security, drive encryption is used more commonly now. As mentioned in Chapter 5, making a
physical acquisition of a drive with whole disk encryption can result in unreadable data.
With a logical acquisition, however, you can still read and analyze the files. Of course, this
method requires a live acquisition (covered in Chapter 10) because you need to log on to
the system.
Disk acquisition formats vary from raw data to vendor-specific proprietary, as you learned in
Chapter 5. The raw data format, typically created with the UNIX/Linux dd command, is
a simple bit-for-bit copy of a data file, a disk partition, or an entire drive. A raw imaging
tool can copy data from one drive to another disk or to segmented files. Because it’s a true
unaltered copy, you can view a raw image file’s contents with any hexadecimal editor, such
as Hex Workshop or WinHex. These tools give you a hexadecimal view (see Figure 6-1) or
a plaintext view of the data.
Figure 6-1 Viewing data in WinHex
Courtesy of X-Ways AG, www.x-ways.net
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
6
256
Chapter 6
Creating smaller segmented files is a typical feature in vendor acquisition tools. Their
purpose is to make it easier to store acquired data on smaller media, such as CDs or
USB drives.
Remote acquisition of files is common in larger organizations. Enterprise-level companies are
geographically diverse, so investigators might not be able to get physical access to systems
without traveling long distances. Popular tools, such as AccessData and EnCase, can do
remote acquisitions of forensics drive images on a network, and these acquisitions can also
be done with a dd command.
Validation and Verification Validation and verification functions work hand in
hand. Validation is a way to confirm that a tool is functioning as intended, and verification
proves that two sets of data are identical by calculating hash values or using another similar
method. Another related process is filtering, which involves sorting and searching through
investigation findings to separate good data and suspicious data. Validating tools and
verifying data are what allow filtering.
To validate a tool, you can use forensic images that have been created for desktop and
mobile devices; these files are posted on Web sites such as NIST’s CFTT or the Scientific
Working Group on Digital Evidence (SWGDE) and tell you what the tool should find as evidence on the drives. They can also give you ranges of results so that you can determine, for
example, that a tool is good for Linux images but has problems with older Windows systems. These groups also publish the results of testing hardware acquisition tools. After validating a tool, you must also make sure all forensic copies of a particular device have the
same hash value.
All forensics acquisition tools have a method for verification of the data-copying process
that compares the original drive with the image. For example, EnCase prompts you to
obtain the MD5 hash value of acquired data, and FTK validates MD5 and SHA-1
hash sets during data acquisition. Hardware acquisition tools, such as Image MASSter
Solo-4, can perform simultaneous MD5 and CRC-32 hashing during data acquisition.
Whether you choose a software or hardware solution for acquisition, make sure the
tool has a hashing function for verification purposes. How data hashing is used depends
on the investigation, but using a hashing algorithm on the entire suspect drive and all
its files is a standard practice. This method produces a unique hexadecimal value for
ensuring that the original data hasn’t changed and copies are of the same unchanged
data or image.
When performing filtering, you separate good data from suspicious data. Good data consists of known files, such as OS files, common programs (Microsoft Word, for example),
and standard files used in a company’s day-to-day business. You can also use hash values
to create a known good hash value list of a fresh installation of an OS, all applications,
and known good images and documents (spreadsheets, text files, and so on). With this
information, an investigator could ignore all files on this known good list and focus on other
files that aren’t on this list. Filtering can also be used to find data for evidence in criminal
investigations or to build a case for terminating an employee. The National Software
Reference Library (NSRL) has compiled a list of known file hashes for a variety of OSs,
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Evaluating Digital Forensics Tool Needs
257
applications, and images that you can download from www.nsrl.nist.gov/Downloads.htm
(see Figure 6-2). It’s also adding hash values for mobile apps, specifically iOS and Android.
You learn more about the NSRL in “Validating and Testing Forensics Software” later in
this chapter.
6
Figure 6-2 The home page of the National Software Reference Library
Source: www.nsrl.nist.gov
Organizations such as the National Center for Missing and Exploited
Children maintain hash sets of photos of known victims. These files
are sorted into the “suspicious” or known bad category.
Several digital forensics tools can integrate known good file hash sets and compare them with
file hashes from a suspect drive to see whether they match. With this process, you can eliminate large amounts of data quickly so that you can focus your evidence analysis. You can
also begin building your own hash sets. Another feature to consider is hashing and comparing sectors of data. It’s useful for identifying fragments of data in slack and free disk space
that might be partially overwritten.
Another way to filter data is analyzing and verifying header values for known file types. Each
file type has a header value associated with a file extension, and many forensics tools include
a list of common file headers. To view these file headers, you use a hexadecimal editor, which
can tell you whether a file extension is incorrect for the file type. Renaming file extensions is
often done to disguise or hide data, and you could miss pertinent data if you don’t check file
headers. A standard indicator for graphics files is the hex value “FF D8,” shown in the first
line of output in the File_Filter.docx file shown in Figure 6-3. (You examine graphics
files in more detail in Chapter 8.) After some practice in viewing file headers, you’ll learn to
recognize common header values.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
258
Chapter 6
Figure 6-3 The file header indicates a .jpeg file
Courtesy of X-Ways AG, www.x-ways.net
Because the File_Filter.docx file has “FF D8 ” in the header, it’s a .jpeg image, not a
.docx file. If you try to open this file in Microsoft Word, you see the error message shown in
Figure 6-4.
Figure 6-4 Error message displayed when trying to open a .jpeg file in Word
Courtesy of Microsoft Corporation
If you open the file with an image viewer, such as Microsoft Paint, you see the image shown
in Figure 6-5.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Evaluating Digital Forensics Tool Needs
259
6
Figure 6-5 File_Filter.docx opened in Paint
Courtesy of Microsoft Corporation and ª 2016 Cengage Learningâ
Searching and comparing file headers rather than file extensions improves filtering. With this
feature, you can locate files that might have been altered intentionally. In Chapters 8 and 9,
you see how to use this feature to locate hidden data.
Extraction The extraction function is the recovery task in a digital investigation and is
the most challenging of all tasks to master. In Chapter 1, you learned how system analysis
applies to an investigation. Recovering data is the first step in analyzing an investigation’s
data. The following subfunctions of extraction are used in investigations:
•
Data viewing
•
Keyword searching
•
Decompressing or uncompressing
•
Carving
•
Decrypting
•
Bookmarking or tagging
Mobile devices have added some complexity to forensic extraction
because so much data can be retrieved from them: call records, URLs,
GPS data, SMS and text messages, and more. You explore mobile
device forensics in Chapter 12.
Many digital forensics tools include a data-viewing mechanism for digital evidence and offer
several ways to view data, including logical drive structures, such as folders and files. These
tools also display allocated file data and unallocated disk areas with special file and disk
viewers. Being able to view this data in its normal form makes analyzing and collecting clues
for the investigation easier.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
260
Chapter 6
A common task in digital investigations is searching for and recovering relevant data. Forensics tools have functions for searching for keywords of interest to the investigation. Using a
keyword search speeds up the analysis process, if used correctly; however, a poor selection of
keywords generates too much information. Another way to narrow down a search is by using
word lists created for a specific case. Figure 6-6 shows an OSForensics built-in file called
“banned sports drugs” used to do an indexed search for the keyword “nucleic acids” in
Charlie’s hard drive from the M57 Patents case.
Figure 6-6 Using a word list to search in OSForensics
Source: PassMark Software, www.osforensics.com
With some tools, you can set filters to select file types to search, such as searching only PDF
files. Another function in some forensics tools, such as X-Ways Forensics and OSForensics, is
indexing all words on a drive. These features speed up keyword searches, which speeds up
analysis.
Another feature to consider for extraction is the format the forensics tool can read. For
example, as you saw in Chapter 4, OSForensics has a feature for reading and indexing
data from Microsoft .pst and .ost files, and EnCase has a third-party add-on that
indexes and analyzes Microsoft .pst files. In addition, EnCase, X-Ways Forensics, and
ProDiscover enable you to create scripts for extracting data, but FTK doesn’t have this
feature. Often you have to use a combination of tools to retrieve and report on evidence
from digital devices accurately.
The investigation process also involves reconstructing fragments of files that have been
deleted from a suspect drive. In North America, this reconstruction is called “carving”; in
Europe, it’s called “salvaging.” (Carving is covered in more depth in Chapters 8 and 16.)
Investigators often need to be able to extract data from unallocated disk space. Locating file
header information, as mentioned in “Validation and Verification,” is a reliable method for
carving data. Most forensics tools analyze unallocated areas of a drive or a forensic image
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Evaluating Digital Forensics Tool Needs
261
and locate fragments or entire file structures that can be carved and copied into a newly
reconstructed file. Some investigators prefer carving fragmented data manually with a
command-line tool, but advanced GUI tools with built-in carving functions are more
common now. Figure 6-7 shows the data-carving feature in OSForensics.
6
Figure 6-7 Data-carving options in OSForensics
Source: PassMark Software, www.osforensics.com
Some tools, such as Simple Carver Suite (www.simplecarver.com) and DataLifter (http://datalifter.
software.informer.com), are specifically designed to carve known data types from exported
unallocated disk space. DataLifter includes a feature that enables you to add other header
values.
There are many compression or zip utilities, such as WinZip, 7Zip, and pzip. When a forensics tool encounters a compressed file or a zip archive as part of a forensic image, it applies
the correct algorithm for uncompressing the files. For example, uncompressing Windows files
is done with the Lempel-Ziv algorithm, Lz32.dll. Other OSs and compression utilities use
other algorithms.
A major challenge in digital investigations is analyzing, recovering, and decrypting data
from encrypted files or systems. Encryption can be used on a drive, disk partition, or file.
Many e-mail services, such as Microsoft Outlook, provide encryption protection for .pst
folders and messages. Encryption can be platform specific, such as Windows Encrypting File
System (EFS) and BitLocker, or done with third-party tools, such as Pretty Good Privacy
(PGP) and GnuPG.
From an investigation perspective, encrypted files and systems are a problem. Many password
recovery tools have a feature for generating potential password lists for a password dictionary
attack. Passwords are typically stored as hash values, not in plaintext, and are meant to be
one-way hashes, meaning you can’t apply an algorithm to break them. Password lists give you
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
262
Chapter 6
a starting point for guessing passwords; in addition, you can try words that are applicable to a
suspect’s profession and hobbies. Passwords are sometimes written to a temporary file or system
file, such as Pagefile.sys, so examining these files is a useful technique, too. OSForensics,
like many forensics tools, has a built-in password cracker. First, it attempts to retrieve browser
and OS passwords, especially if you’re examining a live system. Next, it generates rainbow
tables (files containing password hash values; explained in Chapter 9) and compares hash
values to see whether it can find a match with the password. If it fails, the next step is to run
a brute-force attack on the encrypted file. OSForensics, for example, attempts to recover
Windows logon passwords and has additional features, such as recovering browser passwords.
After locating the evidence, the next task is to bookmark or tag it so that you can refer to
it later when needed. Many forensics tools use bookmarks to insert digital evidence into
a report generator, which produces a technical report in HTML or RTF format of the examination’s findings. When the report generator is started, bookmarks are loaded into the report.
Reconstruction The purpose of having a reconstruction function in a forensics tool is to
re-create a suspect drive to show what happened during a crime or an incident. Another reason for duplicating a suspect drive is to create a copy for other digital investigators, who
might need a fully functional copy of the drive so that they can perform their own acquisition, test, and analysis of the evidence. Reconstruction is also done if a drive has been
compromised by malware or a suspect’s actions.
The following are methods of reconstruction:
•
Disk-to-disk copy
•
Partition-to-partition copy
•
Image-to-disk copy
•
Image-to-partition copy
•
Disk-to-image copy
•
Rebuilding files from data runs and carving
There are several ways to re-create an image of a suspect drive. A decade ago, the ideal method
was using the same make and model disk as the suspect disk, as discussed in Chapter 5, but
disk-to-disk copies are rarely used now. (A partition-to-partition copy is very similar, but you
use partitions instead of disks.) Typically, you copy an image to another location, such as a
partition, a physical disk, or a virtual machine (covered in Chapter 10). The simplest method
of duplicating a drive is using a tool that makes a direct disk-to-image copy from the suspect
disk to the target location. Many tools can perform this task. One free tool is the Linux
dd command, but it has a major disadvantage: It produces a flat, uncompressed file that’s the
same size as the source drive.
Some tools have proprietary formats that can be restored only by the same application that
created them. For example, a ProDiscover image (.eve format) can be restored only by using
ProDiscover. Most tools, however, can convert files to the .E01 or .001 format so that you
can use files in a variety of tools to take advantage of their different strengths.
Forensic analysis is often complicated by time-critical cases, such as those involving kidnapping or homicides, but shadowing drives is a useful technique in these situations. It requires a
hardware device, such as Voom Technologies Shadow Drive, that connects a suspect’s drive
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Evaluating Digital Forensics Tool Needs
263
to a read-only IDE port and another drive to a read-write port that’s called a “shadow
drive.” When the Voom device is connected to a computer, you can access and run applications on the suspect’s drive. All data that would normally be written to the suspect’s drive
is redirected to the shadow drive (“Voom Technologies’ Shadow 3 said to provide a quick
way to investigate computers without compromising evidence,” Government Security News,
February 2014). This tool has been used in court so that expert witnesses could easily show
evidence on a drive and how a suspect could have used the information.
Reporting To perform a forensics disk analysis and examination, you need to create a
report. Before Windows forensics tools were available, this process required copying data
from a suspect drive and extracting the digital evidence manually. The investigator then
copied the evidence to a separate program, such as a word processor, to create a report. File
data that couldn’t be read in a word processor—databases, spreadsheets, and graphics, for
example—made it difficult to insert nonprintable characters, such as binary data, into a
report. Typically, these reports weren’t stored electronically because investigators had to collect printouts from several different applications to consolidate everything into one large
paper report.
Newer forensics tools can produce electronic reports in a variety of formats, such as
word-processing documents, HTML Web pages, and Acrobat PDF files. The following are
subfunctions of the reporting function:
•
Bookmarking or tagging
•
Log reports
•
Report generator
As part of the validation process, often you need to document the steps you took to acquire
data from a suspect drive. Many forensics tools can produce a log report that records an
investigator’s activities and incorporates evidence that was bookmarked or tagged during
extraction. Then a built-in report generator is used to create a report in a variety of formats.
Some tools with report generators that display bookmarked evidence are EnCase, FTK,
OSForensics, ILookIX, X-Ways Forensics, and ProDiscover.
You can add a log report to your final report as documentation of the steps you took during
the examination, which can be useful if repeating the examination is necessary. For a case
that requires peer review, log reports confirm what activities were performed and what
results were found in the original analysis and examination. Keep in mind that reports generated by forensics tools are no substitute for an investigator’s report. Investigators need to
be able to explain their decisions and the output in more detail than a tool-generated report
can produce.
Tool Comparisons
To help determine which forensics tool to purchase, a comparison table of functions, subfunctions, and vendor products is useful. Cross-referencing functions and subfunctions with
vendor products makes it easier to identify the forensics tool that best meets your needs.
Table 6-1 is an example of how to compare forensics vendors’ tools. Your needs might differ
from the functions and subfunctions listed in this table. When developing your own table,
add other functions and subfunctions you think are necessary to determine which tools you
should acquire for an investigation.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
6
264
Chapter 6
Table 6-1 Comparison of forensics tool functions
ProDiscover
Basic
OSForensics,
demo version
AccessData
FTK
Guidance
Software EnCase
Physical data copy
✓
✓
✓
✓
Logical data copy
✓
✓
✓
Data acquisition formats
✓
✓
✓
Function
Acquisition
Command-line processes
GUI processes
✓
✓
✓
Remote acquisition
✓
✓
✓
✓
✓
✓
Validation and verification
Hashing
✓
✓
✓
✓
Verification
✓
✓
✓
✓
Filtering
✓
✓
✓
Analyzing file headers
✓
✓
✓
✓
✓
Extraction
Data viewing
✓
✓
Keyword searching
✓
✓
Decompressing
✓
✓
✓
✓
✓
Carving
✓
✓
Decrypting
✓
✓
✓
✓
✓
✓
Disk-to-disk copy
✓
✓
✓
✓
Partition-to-partition copy
✓
✓
✓
✓
Image-to-disk copy
✓
✓
✓
✓
Image-to-partition copy
✓
✓
✓
✓
Disk-to-image copy
✓
✓
✓
✓
Rebuilding files
✓
✓
✓
✓
Bookmarking
Reconstruction
Reporting
Bookmarking/tagging
✓
✓
✓
✓
✓
✓
✓
✓
✓
Mount virtual machines
✓
✓
✓
E-discovery
✓
✓
✓
Log reports
Report generator
✓
Automation and other features
Scripting language
✓
ª 2016 Cengage Learningâ
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Digital Forensics Software Tools
265
Other Considerations for Tools
As part of the business planning for your lab, you should determine which tools offer the most
flexibility, reliability, and future expandability. The software tools you select should be compatible with the next generation of OSs; for example, Windows 7 and later added features for compatibility with mobile devices. As an investigator, it’s your responsibility to find information on
changes in new hardware or software releases and changes planned for the next release. Because
OS vendors don’t always supply adequate information about future file system upgrades, you
must research and prepare for these changes and develop resources for finding new specifications
if the vendor fails to provide them. For example, when NTFS was introduced with Windows NT,
forensics software vendors revised their products for this new file system, but addressing the file
system changes took some time. Therefore, investigators had to look for alternatives to getting
the data they needed, such as consulting Microsoft resource kits for Windows NT.
Another consideration when maintaining a forensics lab is creating a software library containing older versions of forensics utilities, OSs, and other programs. When purchasing newer and
more versatile tools, you should also ensure that your lab maintains older versions of software
and OSs, such as Windows and Linux. If a new software version fixes one bug but introduces
another, you can use the previous version to overcome problems caused by the new bug.
Digital Forensics Software Tools
Whether you use a suite of tools or a task-specific tool, you have the option of selecting one
that enables you to analyze digital evidence through the command line or in a GUI. The following sections explore some options for command-line and GUI tools in both Windows and
UNIX/Linux.
Macintosh has made a comeback, and more people are using it. Installing Windows on Mac machines is fairly easy, so you can use most
forensics tools on a Mac machine.
Command-Line Forensics Tools
As mentioned in Chapter 1, computers used several OSs before Windows and MS-DOS
dominated the market. During this time, digital forensics wasn’t a major concern. After people started using PCs, however, they figured out how to use them for illegal and destructive
purposes and to commit crimes and civil infractions with them. Software developers began
releasing forensics tools to help private- and public-sector investigators examine PCs. The
first tools that analyzed and extracted data from floppy disks and hard disks were MS-DOS
tools for IBM PC file systems.
One of the first MS-DOS tools used for digital investigations was Norton DiskEdit. This tool
used manual processes that required investigators to spend considerable time on a typical
500 MB drive. Eventually, programs designed for digital forensics were developed for DOS,
Windows, Apple, NetWare, and UNIX systems. Some of these early programs could extract
data from slack and free disk space; others were capable only of retrieving deleted files.
Current programs are more powerful and can search for specific words or characters, import
a keyword list to search, calculate hash values, recover deleted items, conduct physical and
logical analyses, and more.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
6
266
Chapter 6
One advantage of using command-line tools for an investigation is that they require few system resources because they’re designed to run in minimal configurations. In fact, most tools
fit on bootable media (USB drives, CDs, and DVDs). Conducting an initial inquiry or a complete investigation with bootable media can save time and effort. Most tools also produce a
text report that fits on a USB drive or other removable media.
Some command-line forensics tools are created specifically for Windows command-line interface (CLI) platforms; others are created for Macintosh and UNIX/Linux. Because there are
many different versions of UNIX and Linux, these OSs are often referred to as “Linux
platforms.” In Chapter 5, you were introduced to using some command-line tools in Linux,
such as the dd and dcfldd commands. For Windows platforms, a number of companies, such
as NTI, Digital Intelligence, Maresware, DataLifter, and ByteBack, are recognized for their
work in command-line forensics tools.
Some tools that are readily available in the command line are often overlooked. For example,
in Windows 2000 and later, the dir command shows you the file owner if you have multiple
users on the system or network. Try it by following these steps:
1. Open a command prompt window.
2. At the command prompt, type cd n and press Enter to take you to the root directory.
Create a work folder for this chapter by typing md WorknChap06nChapter
(replacing Work with the name of your work folder) and pressing Enter.
3. Make sure you’re at the root directory, and type
dir /q > C:nWorknChap06nChapternFileowner.txt and press Enter.
4. In any text editor, open Fileowner.txt to see the results. You should see your file
structure and whether the files were generated by the system or by a user. When you’re
finished, exit the text editor and close the command prompt window.
Linux Forensics Tools
Although UNIX has been around for many decades, it’s been mostly replaced by Linux; however, you might still encounter systems running UNIX. Many people haven’t used Linux platforms much. However, with GUIs now readily available with Linux platforms, these OSs are
becoming more popular with home and business end users. Because most are free, they’re
increasingly popular in developing and emerging nations. This newfound popularity and
the staggering number of versions give investigators a challenge: learning the Linux command
line and investigating the Linux environment. In Chapter 7, you learn more about several
Linux tools for forensics analysis, such as SMART, Kali Linux, and Autopsy with Sleuth Kit.
This book isn’t geared toward the Linux platform for forensics analysis,
but using a Linux tool for the processes described in this book works
as well as on a Microsoft platform. Also, keep in mind that Linux tools
work well on Windows systems, as you see in Chapter 7.
SMART SMART is designed to be installed on numerous Linux versions, including Gentoo,
Fedora, SUSE, Debian, Knoppix, Ubuntu, Slackware, and more. You can analyze a variety of
file systems with SMART; for a list of file systems or to download an evaluation ISO image for
SMART and SMART Linux, go to www.asrdata.com/forensic-software/software-download/.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Digital Forensics Software Tools
267
SMART includes several plug-in utilities. This modular approach makes it possible to
upgrade SMART components easily and quickly. SMART can also take advantage of multithreading capabilities in OSs and hardware, a feature lacking in other forensics utilities. This
tool is one of the few that can mount different file systems, such as journaling file systems, in
a read-only format.
Another useful option in SMART is the hex viewer, which color-codes hex values to make it
easier to see where a file begins and ends. SMART also offers a reporting feature. Everything
you do during your investigation with SMART is logged, so you can select what you want to
include in a report, such as bookmarks.
Helix 3 One of the easiest suites to use is Helix because of its user interface. Although
Helix is no longer a free package, you can go to www.e-fense.com/products.php to learn
more about it. What’s unique about Helix is that you can load it on a live Windows system,
and it loads as a bootable Linux OS from a cold boot. Its Windows component is used for
live acquisitions. Be aware, however, that some international courts haven’t accepted live
acquisitions as a valid forensics practice.
During corporate investigations, often you need to retrieve RAM and other data, such as
the suspect’s user profile, from a workstation or server that can’t be seized or turned off.
This data is extracted while the system is running and captured in its state at the time of
extraction. Make sure to keep a journal to record what you’re doing, however. To do a live
acquisition, insert the Helix CD/DVD into the suspect’s machine.
Kali Linux Kali Linux, formerly known as BackTrack, is another Linux Live CD used by
many security professionals and forensics investigators. It includes a variety of tools and has
an easy-to-use KDE interface. You can download the ISO image from www.kali.org. Kali
includes several tools, such as Autopsy and Sleuth Kit (discussed next), ophcrack, dcfldd,
MemFetch, and MBoxGrep.
Autopsy and Sleuth Kit Sleuth Kit is a Linux forensics tool, and Autopsy is the
GUI browser interface for accessing Sleuth Kit’s tools. Chapter 7 explains how to use
these tools, but if you’re accessing them from Kali, for example, shut down your Windows
computer with the Kali disc in the CD/DVD drive, making sure your system is set to
boot from the CD/DVD drive before the hard drive. Then do a hard boot to the computer.
In the options that are displayed, select Expert Mode. (Note that this mode is forensically
sound.) If you’re booting from a laptop, you might have display issues. You can click
“scan” to have Kali find the correct settings. (If Kali fails to find these settings, experiment
until you find a setting that works.) After the correct display setting is applied, a GUI is
displayed. If prompted, specify whether to load SCSI modules or additional modules from a
floppy disk.
On your desktop, you should see what drives have been detected. For example, say that
/dev/hda1 and /dev/hda2 are displayed at the upper left. If you click the Kali button,
which is similar to the Start button in Windows, you see the GUI selection. When you select
Forensic Tools, the Autopsy option is displayed. From here, you can open an existing case or
start a new case. For more information on these tools, visit www.sleuthkit.org.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
6
268
Chapter 6
Other GUI Forensics Tools
Several software vendors have introduced forensics tools that work in Windows. Because GUI
forensics tools don’t require the same understanding of the Windows CLI and file systems that
command-line tools do, they can simplify digital forensics investigations. These GUI tools have
also simplified training for beginning examiners; however, you should continue to learn about
and use command-line tools because some GUI tools might miss critical evidence.
Most GUI tools are put together as suites of tools. For example, the largest GUI tool
vendors—AccessData and Guidance Software—offer tools that perform most of the tasks
discussed in this chapter. As with all software, each suite has its strengths and weaknesses.
GUI tools have several advantages, such as ease of use, the capability to perform multiple
tasks, and no requirement to learn older OSs. Their disadvantages range from excessive
resource requirements (needing large amounts of RAM, for example) and producing inconsistent results because of the type of OS used. Another concern with using GUI tools is that they
create investigators’ dependence on using only one tool. In some situations, GUI tools don’t
work and a command-line tool is required, so it’s essential for investigators to be familiar
with more than one type of tool.
Digital Forensics Hardware Tools
This section discusses computer hardware used for forensics investigations. Technology
changes rapidly, and hardware manufacturers have designed most computer components to
last about 18 months between failures. Hardware is hardware; whether it’s a rack-mounted
server or a forensic workstation, eventually it fails. For this reason, you should schedule
equipment replacements periodically—ideally, every 18 months if you use the hardware fulltime. Most digital forensics operations use a workstation 24 hours a day for a week or longer
between complete shutdowns.
You should plan your hardware needs carefully, especially if you have budget limitations.
Include the amount of time you expect the forensic workstation to be running, how often you
expect hardware failures, consultant and vendor fees to support the hardware, and how often
to anticipate replacing forensic workstations. The longer you expect the forensic workstation
to be running, the more you need to anticipate physical equipment failure and the expense of
replacement equipment.
Forensic Workstations
Many hardware vendors offer a wide range of forensic workstations that you can tailor
to meet your investigation needs. The more diverse your investigation environment, the
more options you need. In general, forensic workstations can be divided into the following
categories:
•
Stationary workstation—A tower with several bays and many peripheral devices
•
Portable workstation—A laptop computer with almost as many bays and peripherals
as a stationary workstation
•
Lightweight workstation—Usually a laptop computer built into a carrying case with
a small selection of peripheral options
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Digital Forensics Hardware Tools
269
When considering options to add to a basic workstation, keep in mind that PCs have limitations on how many peripherals they can handle. The more peripherals you add, the more
potential problems you might have, especially if you’re using an older version of Windows.
You must learn to balance what you actually need with what your system can handle. In
addition, remember that RAM and storage need updating as technology advances.
If you’re operating a digital forensics lab for a police agency, you need as many options
as possible to handle any investigation. If possible, use two or three hardware configurations to handle diverse investigations. You should also keep a hardware inventory
in addition to your software library. In the corporate environment, however, consider
streamlining your workstation to meet the needs of only the types of systems used in
your business.
Building Your Own Workstation To decide whether you want to build your own
workstation, first ask “How much do I have to spend?” Building a forensic workstation isn’t
as difficult as it sounds but can quickly become expensive if you aren’t careful. If you have
the time and skill to build your own forensic workstation, you can customize it to your needs
and save money, although you might have trouble finding support for problems that develop.
For example, peripheral devices might conflict with one another, or components might fail. If
you build your own forensic workstation, you should be able to support the hardware. You
also need to identify what you intend to analyze. If you’re analyzing SPARC disks from
workstations in a company network, for example, you need to include a SPARC drive with a
write-protector on your forensic workstation. (Note that SPARC disks are commonly used
with Sun Solaris systems.)
If you decide that building a forensic workstation is beyond your skills, some vendors still
offer workstations designed for digital forensics, such as the F.R.E.D. unit from Digital
Intelligence or hardware mounts from ForensicPC that convert a standard server or PC into a
forensic workstation. Having a vendor-supplied workstation has its advantages. If you aren’t
skilled in hardware maintenance and repair, having vendor support can save you time and
frustration when you have problems. Of course, you can always mix and match components
to get the capabilities you need for your forensic workstation.
If you don’t have the skills to build and support a PC, you might want
to consider taking an A1 certification course.
Using a Write-Blocker
The first item you should consider for a forensic workstation is a write-blocker. Write-blockers
protect evidence disks by preventing data from being written to them. Software and hardware
write-blockers perform the same function but in a different fashion.
Software write-blockers, such as PDBlock from Digital Intelligence, typically run in a shell
mode (such as a Windows CLI). PDBlock changes interrupt 13 of a workstation’s BIOS to
prevent writing to the specified drive. If you attempt to write data to the blocked drive, an
alarm sounds, advising that no writes have occurred. PDBlock can run only in a true DOS
mode, however, not in a Windows CLI.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
6
270
Chapter 6
With hardware write-blockers, you can connect the evidence drive to your workstation and
start the OS as usual. Hardware write-blockers, which act as a bridge between the suspect
drive and the forensic workstation, are ideal for GUI forensics tools. They prevent Windows
or Linux from writing data to the blocked drive.
In the Windows environment, when a write-blocker is installed on an attached drive, the
drive appears as any other attached disk. You can navigate to the blocked drive with any
Windows application, such as File Explorer, to view files or use Word to read files. When
you copy data to the blocked drive or write updates to a file with Word, Windows shows that
the data copy is successful. However, the write-blocker actually discards the written data—in
other words, data is written to null. When you restart the workstation and examine the
blocked drive, you won’t see the data or files you copied to it previously.
Many vendors have developed write-blocking devices that connect to a computer through
FireWire, USB 2.0 and 3.0, SATA, PATA, and SCSI controllers. Most of these write-blockers
enable you to remove and reconnect drives without having to shut down your workstation,
which saves time in processing the evidence drive. For more information on write-blocker
specifications, visit www.cftt.nist.gov. The following vendors offer write-blocking devices:
•
www.digitalintelligence.com
•
www.forensicpc.com
•
www.guidancesoftware.com
•
www.voomtech.com
•
www.mykeytech.com
•
www.lc-tech.com
•
www.logicube.com
•
www.forensic-computers.com
•
www.cru-inc.com
•
www.paraben.com
•
www.usbgear.com/USB-FORENSIC.html
Recommendations for a Forensic Workstation
Before you purchase or build a forensic workstation, determine where your data acquisitions
will take place. If you acquire data in the field, consider streamlining the tools you use. With
the newer FireWire and USB write-blocking devices, you can acquire data easily with Digital
Intelligence FireChief and a laptop computer, for example. If you want to reduce the hardware you carry, consider a product such as the WiebeTech Forensic DriveDock with its
regular DriveDock FireWire bridge or the Logicube Talon.
When choosing a computer as a stationary or lightweight forensic workstation, you want
a full tower to allow for expansion devices, such as a 2.5-inch drive converter to analyze a
laptop hard drive on a 3.5-inch IDE write-protected drive controller. You want as much
memory and processor power as your budget allows and different sizes of hard drives. In
addition, consider a 400-watt or better power supply with battery backup, extra power and
data cables, a SCSI controller card, external FireWire and USB ports, an assortment of drive
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Validating and Testing Forensics Software
271
adapter bridges to connect SATA to IDE (PATA) drives, an ergonomic keyboard and mouse,
and a good video card with at least a 17-inch monitor. If you plan to conduct many investigations, a high-end video card and dual monitors are recommended. If you have a limited
budget, one option for outfitting your lab is to use high-end game PCs from a local computer
store. With some minor modifications and additions of hardware components, these systems
perform extremely well.
As with any technology, what your forensic workstation includes is often a matter of preference.
Whatever vendor you choose, make sure the devices you select perform the functions you expect
to need as an investigator.
Validating and Testing Forensics Software
Now that you have selected some tools to use, you need to make sure the evidence you
recover and analyze can be admitted in court. To do this, you must test and validate your
software. The following sections discuss validation tools available at the time of this writing
and how to develop your own validation protocols.
Using National Institute of Standards and Technology Tools
The National Institute of Standards and Technology (NIST) publishes articles, provides tools,
and creates procedures for testing and validating computer forensics software. Software
should be verified to improve evidence admissibility in judicial proceedings. NIST sponsors
the CFTT project to manage research on forensics tools. For additional information on this
testing project, visit www.cftt.nist.gov. The Computer Forensic Reference Data Sets (CFReDS;
www.cfreds.nist.gov) has been created recently to provide data sets for tools, training, and
hardware testing.
NIST also created criteria for testing forensics tools, which are included in the article
“General Test Methodology for Computer Forensic Tools” (version 1.9, November 7, 2001),
available at www.cftt.nist.gov/testdocs.html. This article addresses the lack of specifications
for what forensics tools should do and the importance of tools meeting judicial scrutiny. The
criteria are based on standard testing methods and ISO 17025 criteria for testing when no
current standards are available. Your lab must meet the following criteria and keep accurate
records so that when new software and hardware become available, testing standards are in
place for your lab:
•
Establish categories for digital forensics tools—Group digital forensics software
according to categories, such as forensics tools designed to retrieve and trace e-mail.
•
Identify forensics category requirements—For each category, describe the technical
features or functions a forensics tool must have.
•
Develop test assertions—Based on the requirements, create tests that prove or disprove
the tool’s capability to meet the requirements.
•
Identify test cases—Find or create types of cases to investigate with the forensics tool,
and identify information to retrieve from a sample drive or other media. For example,
use the image of a closed case file created with a trusted forensics tool to test a new tool
in the same category and see whether it produces the same results.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
6
272
Chapter 6
•
Establish a test method—Considering the tool’s purpose and design, specify how to
test it.
•
Report test results—Describe the test results in a report that complies with ISO 17025,
which requires accurate, clear, unambiguous, and objective test reports.
Another standards document, ISO 5725, demands accuracy for all aspects of the testing process, so results must be repeatable and reproducible. “Repeatable results” means that if you
work in the same lab on the same machine, you generate the same results. “Reproducible
results” means that if you’re in a different lab working on a different machine, the tool still
retrieves the same information.
NIST has also developed several tools for evaluating drive-imaging tools.
These tools are posted on the CFTT Web site at www.cftt.nist.gov/
disk_imaging.htm.
In addition, NIST created the NSRL project (www.nsrl.nist.gov) with the goal of collecting
all known hash values for commercial software and OS files. The primary hash NSRL uses
is SHA-1, which generates known digital signatures called the Reference Data Set (RDS).
SHA-1 has better accuracy than other hashing methods, such as MD5. The purpose of collecting known hash values is to reduce the number of known files, such as OS or program
files, included in a forensics examination of a drive so that only unknown files are left. You
can also use the RDS to locate and identify known bad files, such as illegal images and
computer viruses, on a suspect drive.
Using Validation Protocols
After retrieving and examining evidence data with one tool, you should verify your results by
performing the same tasks with other similar forensics tools. For example, after you use one
forensics tool to retrieve disk data, you use another to see whether you retrieve the same
information. Although this step might seem unnecessary, you might be asked on the witness
stand “How did you verify your results?” To satisfy the need for verification, you need at
least two tools to validate software or hardware upgrades. The tool you use to validate the
results should be well tested and documented. A hands-on project at the end of this chapter
gives you a chance to validate tools.
Investigators must be confident in a tool’s capability to produce consistent and accurate findings during analysis. Understanding how the tool works is equally important, as you might
not have vendor support in a courtroom. One way to compare results and verify a new tool
is by using a disk editor, such as Hex Workshop or WinHex, to view data on a disk in its
raw format. Disk editors typically show files, file headers, file slack, and other data on the
physical disk. Although disk editors aren’t known for their flashy interfaces, they’re reliable
and capable of accessing sectors of the digital evidence to verify your findings.
Although a disk editor gives you the most flexibility in testing, it might
not be capable of examining a compressed file’s contents, such as
a .zip file or an Outlook .pst file. This is another reason that testing
and validating your tools’ capabilities are essential.
If you decide to use a GUI forensics tool, use the recommended steps in the following sections
to validate your findings.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Chapter Summary
273
Digital Forensics Examination Protocol
1. First, conduct your investigation of the digital evidence with one GUI tool.
2. Then perform the same investigation with a disk editor to verify that the GUI tool is
seeing the same digital evidence in the same places on the test or suspect drive’s image.
3. If a file is recovered, obtain the hash value with the GUI tool and the disk editor, and
then compare the results to verify whether the file has the same value in both tools.
Many investigators in both the public and private sectors use FTK and EnCase as their
choice of “flagship” forensics software suites, but they don’t rely on them solely; investigators’ software libraries often include other forensics utilities to supplement these tools’
capabilities.
Digital Forensics Tool Upgrade Protocol In addition to verifying your results
by using two disk-analysis tools, you should test all new releases and OS patches and
upgrades to make sure they’re reliable and don’t corrupt evidence data. New releases and
OS upgrades and patches can affect the way your forensics tools perform. If you determine
that a patch or upgrade isn’t reliable, don’t use it on your forensic workstation until the
problem has been fixed. If you have a problem, such as not being able to read old image
files with the new release or the disk editor generating errors after you apply the latest service pack, you can file an error report with the vendor. In most cases, the vendor addresses
the problem and provides a new patch, which you should check with another round of
validation testing.
One of the best ways to test patches and upgrades is to build a test hard disk to store data in
unused space allocated for a file, also known as file slack. You can then use a forensics tool
to retrieve it. If you can retrieve the data with that tool and verify your findings with a second
tool, you know the tool is reliable.
As digital forensics tools continue to evolve, you should check the Web for new editions,
updates, patches, and validation tests for your tools. Always validate what the hardware or
software tool is doing as opposed to what it’s supposed to be doing, and remember to test
and document why a tool does or doesn’t work the way it’s supposed to.
Chapter Summary
䊏
Consult your business plan to get the best hardware and software solution for your
digital investigation needs.
䊏
The functions required for digital forensics tools are acquisition, validation and
verification, extraction, reconstruction, and reporting.
䊏
For your forensics lab, you should create a software library for older versions of
forensics utilities, OSs, and applications and maintain older versions of software
you have used and retired, such as previous versions of Windows and Linux.
䊏
Some forensics tools run in a command-line interface, including those that can find file
slack and free space, recover data, and search by keyword. They are designed to run in
minimal configurations and can fit on a bootable disk.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
6
274
Chapter 6
䊏
Hardware required for digital forensics includes workstations and devices, such as
write-blockers, to prevent contamination of evidence. Before you purchase or build a
forensic workstation, consider where you acquire data, which determines the hardware
configuration you need.
䊏
Tools that run in Windows and other GUI environments don’t require the same
level of computing expertise as command-line tools and can simplify training
and investigations.
䊏
Before upgrading to a new version of a forensics tool, run a validation test on the new
version. The National Institute of Standards and Technology has standard guidelines
for verifying forensics tools.
Key Terms
acquisition The process of creating a duplicate image of data; one of the required functions
of digital forensics tools.
brute-force attack The process of trying every combination of characters—letters, numbers,
and special characters typically found on a keyboard—to find a matching password or
passphrase value for an encrypted file.
Computer Forensics Tool Testing (CFTT) A project sponsored by the National Institute of
Standards and Technology to manage research on digital forensics tools.
extraction The process of pulling relevant data from an image and recovering or
reconstructing data fragments; one of the required functions of digital forensics tools.
keyword search A method of finding files or other information by entering relevant
characters, words, or phrases in a search tool.
National Software Reference Library (NSRL) A NIST project with the goal of collecting all
known hash values for commercial software and OS files.
password dictionary attack An attack that uses a collection of words or phrases that might
be passwords for an encrypted file. Password recovery programs can use a password
dictionary to compare potential passwords to an encrypted file’s password or passphrase
hash values.
reconstruction The process of rebuilding data files; one of the required functions of digital
forensics tools.
validation A way to confirm that a tool is functioning as intended; one of the functions of
digital forensics tools.
verification The process of proving that two sets of data are identical by calculating hash
values or using another similar method.
write-blocker A hardware device or software program that prevents a computer from writing
data to an evidence drive. Software write-blockers typically alter interrupt-13 write functions
to a drive in a PC’s BIOS. Hardware write-blockers are usually bridging devices between a
drive and the forensic workstation.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Review Questions
275
Review Questions
1. Forensic software tools are grouped into ____________ and _______________ applications.
2. According to ISO standard 27037, which of the following is an important factor in data
acquisition? (Choose all that apply.)
a. The DEFR’s competency
b.
The DEFR’s skills in using the command line
c.
Use of validated tools
d.
Conditions at the acquisition setting
3. One reason to choose a logical acquisition is an encrypted drive. True or False?
4. Hashing, filtering, and file header analysis make up which function of digital forensics tools?
a. Validation and verification
b.
Acquisition
c.
Extraction
d.
Reconstruction
5. Hardware acquisition tools typically have built-in software for data analysis. True or False?
6. The reconstruction function is needed for which of the following purposes? (Choose all
that apply.)
a. Re-create a suspect drive to show what happened.
b.
Create a copy of a drive for other investigators.
c.
Recover file headers.
d.
Re-create a drive compromised by malware.
7. List three subfunctions of the extraction function.
8. Data can’t be written to disk with a command-line tool. True or False?
9. Hash values are used for which of the following purposes? (Choose all that apply.)
a. Determining file size
b.
Filtering known good files from potentially suspicious data
c.
Reconstructing file fragments
d.
Validating that the original data hasn’t changed
10. In testing tools, the term “reproducible results” means that if you work in the same lab
on the same machine, you generate the same results. True or False?
11. The verification function does which of the following?
a. Proves that a tool performs as intended
b.
Creates segmented files
c.
Proves that two sets of data are identical via hash values
d.
Verifies hex editors
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
6
276
Chapter 6
12. What’s the advantage of a write-blocking device that connects to a computer through a
FireWire or USB controller?
13. Building a forensic workstation is more expensive than purchasing one. True or False?
14. A live acquisition is considered an accepted practice in digital forensics. True or False?
15. Which of the following is true of most drive-imaging tools? (Choose all that apply.)
a. They perform the same function as a backup.
b.
They ensure that the original drive doesn’t become corrupt and damage the digital
evidence.
c.
They create a copy of the original drive.
d.
They must be run from the command line.
16. The standards for testing forensics tools are based on which criteria?
a. U.S. Title 18
b.
ASTD 1975
c.
ISO 17025
d.
All of the above
17. A log report in forensics tools does which of the following?
a. Tracks file types
b.
Monitors network intrusion attempts
c.
Records an investigator’s actions in examining a case
d.
Lists known good files
18. When validating the results of a forensic analysis, you should do which of the following?
(Choose all that apply.)
a. Calculate the hash value with two different tools.
b.
Use a different tool to compare the results of evidence you find.
c.
Repeat the steps used to obtain the digital evidence, using the same tool, and
recalculate the hash value to verify the results.
d.
Use a command-line tool and then a GUI tool.
19. The primary hash the NSRL project uses is SHA-1. True or False?
Hands-On Projects
If necessary, go to the M57 Patents site (http://digitalcorpora.org/corpora/
scenarios/m57-patents-scenario) and download the PowerPoint files, Charlie’s
hard drive (dated 7 Dec 2009), and the warrants. In addition, create a Work/
Chap06/Projects folder on your system before starting the projects; it’s referred
to as your “work folder” in steps.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
277
Hands-On Project 6-1
In this project, you create and delete Word and Excel files on a USB drive (or
small disk partition, if you don’t have a USB drive), and then use OSForensics
to examine the drive. Follow these steps:
1. Create a C6Prj01 folder on your USB drive or disk partition.
2. Open a new document in Word, and type This is to test deleting files and
then wiping them. Save the file in the C6Prj01 folder as Test 6-1.docx,
and exit Word.
3. Open a new workbook in Excel. Type a few numbers, and then save the
workbook in the C6Prj01 folder as Test 6-2.xlsx. Exit Excel.
4. Use Windows Explorer or My Computer to delete both files from the USB
or disk drive.
5. Start OSForensics, and start a new case. Type C6Prj01 for the case name,
and enter your name for the investigator. Leave the Acquisition Type option
as Live Acquisition of Current Machine, and specify the work folder you
created for this chapter. Create a subfolder called C6Prj01, and click OK.
6. If necessary, click Manage Case in the left pane, and then click the
Add Device button in the right pane. Click the drive letter of your
USB device, make sure the Forensics mode option button is selected,
and click OK.
7. Make sure the case you just created has a green check mark next to it; if
not, double-click the case name, and then click Start in the left pane. Using
the scroll bar on the far right, scroll down and click the Deleted Files &
Data Carving icon. In the Deleted Files Search window, click the Disk list
arrow, and then click the USB drive in the list of options. Click the Search
button. Because you’re searching for deleted files, you don’t need to enter
a file string or filter.
8. Double-click the Test 6-1.docx file in the lower pane to view its
contents. You can also click the File Info tab to verify the file’s MAC
time. Repeat this process with the Test 6-2.xlsx file.
9. Close all open windows, and exit OSForensics.
Hands-On Project 6-2
In this project, you research and download a disk-cleaning and wiping tool
and verify that it works. Make sure you aren’t on a production machine. Do
an Internet search for disk-cleaning and wiping software, and download and
install at least one tool. Then follow these steps:
1. Create a C6Prj02 folder on your USB or disk drive. Start the tool you just
installed.
2. Select your USB drive. Following instructions in the software documentation,
wipe the drive.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
6
278
Chapter 6
3. Start OSForensics, and start a new case. Type your name for the
investigator’s name, type C6Prj02 for the case name, and enter your
work folder as the case path. Create a subfolder called C6Prj02, and
click OK.
4. Click the Add Device button. Click the Drive Letter option button, if
necessary, and in the drop-down list box, click the drive letter for your
USB drive. Click OK.
5. Click Start in the left pane, if necessary, and click the Deleted Files Search
button on the left. (Note: This is another way to open the Deleted Files
Search window.)
6. Click the Disk list arrow, and then click the USB drive in the list of options.
Click the Search button. Because you’re searching for deleted files, you
don’t need to enter a file string.
7. Double-click any file in the lower pane to open it.
8. If necessary, click the Hex/String Viewer tab (see Figure 6-8). It should
show hexadecimal 0 values, which verifies that the disk wipe worked.
Take a screenshot, and then exit OSForensics. Write a short report
on the tool’s effectiveness, and turn it in to your instructor with the
screenshot.
Figure 6-8 The Hex/String Viewer tab
Source: PassMark Software, www.osforensics.com
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
279
Hands-On Project 6-3
In this project, you create a test drive by planting evidence in the file slack
space on a USB drive or small disk partition. Then you use Hex Workshop
(which you downloaded in a previous chapter from www.hexworkshop.com)
to verify that the drive contains evidence. Follow these steps:
1. First, you format the drive in File Explorer. Right-click the drive icon and
click Format, click to clear the Quick Format check box, if necessary, and
then click Start. If you see a warning message, click OK to continue, and
then click OK in the Format Complete message box.
2. Create a C6Prj03 folder on the USB or disk drive. Warning: This drive
should contain data you no longer need.
3. Open a new document in Word, and type Testing for string Millennium.
Save the file in the C6Prj03 folder as C6Prj03a.docx.
4. Close the file, start a new Word document, and type Testing for string XYZX.
Save the file in the C6Prj03 folder as C6Prj03b.docx. Exit Word.
Next, you use Hex Workshop to hide information in file slack space:
1. Start Hex Workshop. On a sheet of paper, create a chart with two
columns. Label the columns Item and Sector.
2. In Hex Workshop, click Disk, Open Drive from the menu.
(Note: Whenever you see the UAC message box, click Yes.)
Make sure the USB or disk drive is selected, and then click OK.
3. Click File, Open from the menu. Navigate to and double-click
C6Prj03a.docx. Scroll down until you see “Testing for string
Millennium.”
4. Click the tab corresponding to your USB or disk drive, and then click at
the beginning of the right column. Click Edit, Find from the menu. In the
Find dialog box, make sure Text String is selected in the Type list box.
Type Millennium in the Value text box, and then click OK. (If Hex
Workshop doesn’t find “Millennium” the first time, repeat this step.)
5. In the Item column on your chart, write C6Prj03a.docx. In the Sector
column, write the sector number containing the search text, as shown
on the Hex Workshop title bar.
6. Scroll to the bottom of the sector, if necessary. Type Murder She Wrote
near the end of the sector in the right pane, and then click the Save toolbar
button. (Note: If you’re asked to enable Insert mode, click OK, press
Insert, click to select the Disable notification message check box, and
click OK, if necessary.)
7. Click the C6Prj03a.docx tab. Click Edit, Find from the menu, make
sure Text String is selected in the Type list box, type Murder in the
Value text box, and then click OK. Hex Workshop can’t find this text
in C6Prj03a.docx. Click Edit, Find from the menu, and then click OK
to verify that Hex Workshop doesn’t find “Murder” in the document.
Close the file by clicking the lower Close button in the upper-right corner.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
6
280
Chapter 6
8. Click File, Open from the menu. Navigate to and double-click
C6Prj03b.docx. Scroll down, if needed, until you see the “Testing for
string XYZX” text you entered earlier. (Hint: You might need to use the
Find command more than once to find this text.)
9. Click the tab for your USB or disk drive, if necessary, and then click at
the beginning of the right column. Click Edit, Find from the menu, type
XYZX as the value you want to find, and then click OK. On your chart,
write C6Prj03b.docx as the filename in the Item column, and in the Sector
column, note the sector number containing the search text, as shown on
the Hex Workshop title bar.
10. In the tab for your USB or disk drive, type I Spy near the end of the
sector in the right pane, in the slack space, and then click the Save
toolbar button.
11. Verify that “I Spy” doesn’t appear as part of the file by clicking the
C6Prj03b.docx tab and searching for this string twice.
12. Close the C6Prj03b.docx file, and exit Hex Workshop.
In a forensics lab, you would generate the drive’s
MD5, SHA-1, or other hash value with a tool such as
md5sum, and then generate a copy with one of the
GUI tools covered in this chapter.
Hands-On Project 6-4
You should test new or updated digital forensics tools to make sure they’re performing correctly. When complex software applications are updated, they
might create new problems and function failures the vendor wasn’t aware of.
In this project, you test two competing digital forensics analysis tools to see
how they compare in locating and recovering data. Keep in mind that even
though tools have different strengths, they should yield similar results. To compare OSForensics and ProDiscover Basic, you need the following:
• ProDiscover Basic installed on your workstation
• OSForensics installed on your workstation
• Charlie’s hard drive file from the M57 Patents case (available at
http://digitalcorpora.org/corp/nps/scenarios/2009-m57-patents/drives-redacted/)
extracted to your work folder
First, you use ProDiscover Basic to examine the file:
1. Start ProDiscover Basic. To start your analysis, click the New Project toolbar
button. In the New Project dialog box, type C6Prj04PD for the project
number and project filename, and then click OK. (Note: If you get an error
when starting a new project, exit ProDiscover and start it again.)
2. In the tree view, click to expand Add, and then click Image File.
In the Open dialog box, navigate to your work folder, click
charlie-2009-12-07.E01, and then click Open.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
281
3. In the tree view, click to expand Content View and then Images. Click
to expand the image file, expand the C drive, and then click All Files.
If necessary, click Yes in the ProDiscover message box that opens.
4. Next, click the Search toolbar button. Search terms have been created for
the M57 case. In the Search dialog box, click the Content Search tab, if
necessary. In the Search for the pattern(s) text box, type project2400 on
one line and craigslist on a second line. Under Select the Disk(s)/Image(s)
you want to search in, click the .e01 image file, and then click OK.
This search might take quite a while.
5. In the Search 1 tab of the search results, click the Filter button, and then
click project2400. Read the files, and then click the Selection button and
click Select All. (Close the Add Comment dialog box, if it opens.) When
you’re finished, click Add to Report.
6. Click the Search toolbar button. In the Search dialog box, click the Content
Search tab, if necessary. In the Search for the pattern(s) text box, type kitty
and kitten on separate lines. Under Select the Disk(s)/Image(s) you want to
search in, click the .e01 image file, and then click OK.
7. In the Search 2 tab of the search results, click the Filter button, and then
click kitty. Click the check box next to the one file that doesn’t have an
extension, and then click Add to Report.
8. In the tree view, click Report, and then click the Export toolbar button.
In the Export dialog box, click the RTF Format option button, click Browse,
and navigate to and double-click your work folder. Type Chap6-4-PD.rtf in
the File name text box, and then click Save. Click OK in the Export dialog
box, and then click File, Print Report from the menu to print your report.
9. When you’re finished, click File, Exit from the menu. When prompted, click
Yes, and then click Save.
Next, you perform the same searches in OSForensics:
Before starting this part of the project, create a
subfolder of your work folder called C6Prj04.
1. Start OSForensics. Click Start in the left pane, if necessary, and in the right
pane, click Create Case.
2. In the New Case dialog box, enter your name for the investigator, type
C6Prj04 for the case name, and click the Investigate Disk(s) from Another
Machine option button for the acquisition type. Click Custom Location
for the case folder, click the Browse button, navigate to and click your
Work/C6Prj04 folder, and then click OK twice.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
6
282
Chapter 6
3. Click the Add Device button. Click the Image File option button, and then
browse to your work folder, click the charlie-2009-12-07.E01 image
file, and click Open. Click OK twice.
4. Click the Create Index button in the left pane. In the Step 1 of 5 window,
click the Use Pre-defined File Types option button, click all the file types
listed, and then click Next. In the Step 2 of 5 window, click the Add
button, click charlie-2009-12-07.E01, click OK, and then click
Next. In the Step 3 of 5 window, type Index all file types in the Index
Title text box, and then click Start Indexing.
5. When OSForensics finishes indexing the image file, click OK in the
message box.
Indexing might take an hour or more, so make sure
you allow enough time.
6. Click the Search Index button in the left pane. In the Enter Search Words
text box, type project2400, and then click Search in the right pane.
Right-click each file in the results, point to Bookmark, and click Red.
7. In the Enter Search Words text box, type craigslist, and then click Search
in the right pane. Right-click each file in the results, point to Bookmark,
and click Yellow. Repeat this procedure with the search terms kitty and
kitten, assigning the bookmark color red to kitty and the bookmark color
yellow to kitten. (Note: In ProDiscover, you simply selected the file without
an extension for the search term “kitty.”)
8. When you’re done, click the Start button, and then click the Generate
Report button. Accept the default settings, and click OK. In the report,
notice your bookmarked files toward the bottom.
9. Compare the files you found with those found in ProDiscover, and
note any discrepancies. Write a two- to three-page report, including
screenshots, to submit to your instructor. Explain which tool you prefer
to use and why.
10. Exit your Web browser, and exit OSForensics.
Case Projects
Case Project 6-1
Do Internet research on two widely used GUI tools, Guidance Software EnCase
and AccessData FTK, and compare their features with other products, such as
ProDiscover (www.techpathways.com) and Ontrack EasyRecover Professional
(www.ontrack.com/easyrecoveryprofessional). Create a chart outlining each
tool’s current capabilities, and write a one- to two-page report on the features
you found most beneficial for your lab.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Case Projects
283
Case Project 6-2
Research hex editors available for Mac OS and Linux. Based on the documentation, how easy would validating these tools be? Select at least two hex editors
for each OS, and write a one- to two-page paper describing what you would
do to validate them, based on what you have learned in this chapter.
Case Project 6-3
You need to establish a procedure for your organization on how to validate a
new forensics software package. Write two to three pages outlining the procedure you plan to use in your lab. Be sure to cite references, such as the ISO
standard or NIST, to support your procedure.
6
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
chapter
7
Linux and Macintosh
File Systems
After reading this chapter and completing
the exercises, you will be able to:
• Describe Linux file structures
• Describe Macintosh file structures
• Use Linux forensics tools
285
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
286
Chapter 7
In Chapter 5, you explored Microsoft OSs and file systems. Because digital forensics
investigators must understand how OSs store and manage data, this chapter continues this
exploration by examining Linux and Mac file structures. In addition, this chapter introduces
some hands-on approaches to identifying Linux file structures with tools such as X-Ways
Forensics, OSForensics, and WinHex.
Examining Linux File Structures
UNIX was created in the early 1970s to be a multiuser, multithreaded, secure OS, and many
UNIX-based OSs followed. They came in many “flavors” (the term often used for different
distributions), but the Open Group was created as a neutral standards consortium that determines and certifies when an OS meets UNIX requirements. For more information, see
www.unix.org/online.html.
Some notable UNIX distributions included Silicon Graphics, Inc. (SGI) IRIX, Santa Cruz
Operation (SCO) UnixWare, Sun Solaris, IBM AIX, and HP-UX. Most are no longer available, however. Referring to Linux as a “UNIX system” or “UNIX variety” isn’t technically
correct, as it isn’t UNIX certified. However, it’s available in even more flavors than UNIX
had in its heyday. In addition, the Linux kernel is usually packaged with other software
components, such as a GUI and applications, so that users don’t have to combine several
open-source elements to create a working environment.
The most widely used distributions include Ubuntu (a Debian-based OS), Debian, Red Hat,
OpenSUSE, and Slackware. The term “kernel” is often used when discussing Linux because
technically, Linux is only the core of the OS. Linus Torvalds, the inventor of Linux, maintains the official kernel. All other tools, graphical interfaces, and so forth are maintained and
developed by others. Despite the association of the word “kernel” with Linux terminology,
all UNIX-like OSs have a kernel, and so do all Windows OSs.
Ubuntu 14.04 is a long-term support (LTS) version of Ubuntu, meaning it will be supported for the next five years. In some activities in this
book, Ubuntu 12.04 is used; it’s also an LTS version.
Table 7-1 lists several Linux system files containing information about users and their activities, and Table 7-2 lists important top-level directories in Linux.
Table 7-1 Linux system files
System file
Contents
/etc/exports
File systems exported to remote hosts; might include remote drive mappings
/etc/fstab
File system table of devices and mount points
/var/log/lastlog
User’s last logon
/var/log/wtmp
Logon and logoff history information
/var/run/utmp
Current user’s logon information
/var/log/dmesg
System messages log
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining Linux File Structures
287
Table 7-1 Linux system files (Continued )
System file
Contents
/var/log/syslog
System log, occasionally called system.log or kernel.log
/etc/shadow
Master password file, containing hashed passwords for the local system
/etc/group
Group memberships for the local system
Account information for the local system
/etc/passwd
â
ª 2016 Cengage Learning
Table 7-2 Core top-level directories of a Linux system
Directory
Contents
/usr
Most applications and commands are in this directory or its subdirectories bin (stands
for “binary” and contains binary files required at boot time) and sbin (which
requires superuser permission to run the binaries in it).
/etc
Most system configuration files are stored in this directory.
/home
The home directories for all users, usually named after their usernames.
/root
The home directory for the root user (superuser), which is kept separate from other
user home directories.
/dev
Device files that act as stand-ins for the devices they represent, as described in
Chapter 3; for example, /dev/sda is the first non-IDE disk drive on the system,
usually the main hard drive.
/var
Subdirectories such as log (often useful for investigations), mail (storing e-mail
accounts), and spool (where print jobs are spooled).
ª 2016 Cengage Learningâ
Before beginning this activity, create a C:nWorknChap07nChapter
folder (referred to as your “work folder” in steps). Extract all files in
the Chap07 folder on the DVD to your C:nWorknChap07nChapter
folder.
Chapter 3 covered Linux commands for acquiring images. In this section, you use standard
commands to find information about your Linux system. Most of the commands used in this
activity work the same in all UNIX-like OSs, including Mac OSs. Remember that UNIX and
Linux commands are case sensitive, as you learned in Chapter 3. The wrong capitalization can
mean your commands are rejected as incorrect or interpreted as something different. If you
don’t have Ubuntu 14.04 installed, follow these steps to create a virtual machine for running it.
1. Start VirtualBox, and click the New icon at the upper left to start the Create Virtual
Machine Wizard.
2. In the Name and operating system window, type Ubuntu 14.04 for the virtual machine
name. Accept the default settings, and click Next.
3. In the Memory size window, increase the setting to 1024, and then click Next.
4. In the Hard drive window, click Create a virtual hard drive now, and then click Create.
In the Hard drive file type window, click Virtual Machine Disk (VMDK), and then
click Next. In the “Storage on physical hard drive” window, click the Dynamically
allocated option button, and then click Next.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
7
288
Chapter 7
5. In the File location and size window, increase the setting to 20 GB, and then click
Create. Leave VirtualBox open.
6. Start a Web browser, go to www.ubuntu.com/download, and download the ISO image
for Ubuntu 14.04.
7. In the Oracle VM VirtualBox Manager, click the Settings icon.
8. Click Storage in the left pane. In the Storage Tree section, click Empty under Controller:
IDE. In the Attributes section on the right, click the down arrow next to the CD icon
(see Figure 7-1). Click Choose a virtual CD/DVD disk file. Navigate to the folder where
the ISO file is stored, double-click the ISO file, and then click OK.
CD icon
Figure 7-1 Selecting the source for an ISO file
Source: Oracle VirtualBox
9. In the Oracle VM VirtualBox Manager, click the Ubuntu 14.04 virtual machine, and
then click the Start icon. The VM should follow a standard OS installation. Accept the
default settings. Leave the virtual machine running for the next activity.
Before moving on to working with Linux forensics tools, the following activity gives you a
chance to review some commands. For example, being able to find a machine’s name is
always useful; the uname command is used for this task. Displaying file listings and permissions are also useful for investigators. To help with these tasks, you can use the > character
to redirect the output of the command preceding it to a file you specify. If the file exists, it’s
overwritten with a new one; if the file doesn’t exist, it’s created. The double >> adds output
at the end of a specified file, if it already exists.
For all the commands in the following activity, you can see their output in the terminal
window or add the output to your log file by entering >> ~/my.log at the end of each command. (The ~ character specifies the current user’s home directory.) Use the echo command
to add notes or headings in the log, and add blank lines to make the contents easier to read.
Just don’t forget that a single > character replaces the entire file instead of appending to it.
You aren’t prompted that you’re overwriting the file.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining Linux File Structures
289
As you’ve learned, Linux commands use options to create variations of a command. There’s
no difference between grouping letter arguments (such as l and a) after a single - or entering
them separately. Therefore, ls -la functions the same as ls -l -a. Arguments consisting of
multiple letters must be preceded by two -- characters instead of one and can’t be grouped
together, as in ls --all.
As you’ve learned in previous chapters, the pipe ( j ) character also redirects the output of the
command preceding it. Unlike the > character, however, it redirects output as input for the
following command. As you see in this activity, the output of the cat command (which
would have displayed the entire file in the terminal window) is sent to the grep command
to search for occurrences of your username. The grep command then displays only lines
matching search criteria.
1. Start Ubuntu 14.04, if necessary. On the left side of the desktop are icons for different
categories of applications. You can use these desktop icons to select an application, or
click the Ubuntu icon and start typing the name of the application you want to have
the system make a suggestion (see Figure 7-2). Type term (in this case, to suggest
opening the terminal window), and click the Terminal icon.
Figure 7-2 Opening the terminal window
Source: www.ubuntu.com
2. To find the name of your computer and the Linux kernel revision number, type
uname -a and press Enter. To record the results in a file, type uname -a > ~/my.log
and press Enter. Nothing is displayed in the terminal window, but a file called my.log
is created in your user profile folder, and the output of the uname -a command is
redirected to it.
3. To identify your current path, type pwd (which stands for “print working directory”)
and press Enter. In a new terminal window, it’s likely the user’s home directory.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
7
290
Chapter 7
4. To see a list of the directory’s contents, type ls and press Enter. For comparison,
try typing ls -l and pressing Enter, and then typing ls -la and pressing Enter.
(Note: In listings, all files beginning with the . character are usually omitted, unless
you add the a option, which stands for “all.”)
5. To record the full listing in the same log file you created earlier, type echo "" >>
~/my.log and press Enter, and then type echo "Full listing:" >> ~/my.log
and press Enter. Finally, type ls -la >> ~/my.log and press Enter. These commands add a blank line, followed by the heading Full listing:, and finally the
listing of the directory’s contents in your log file.
6. To see the updated contents of your log file, type cat ~/my.log and press Enter.
In current versions of Gnome, which is the Ubuntu desktop, the terminal window’s scrollbar doesn’t show, but you can display it by moving
your mouse pointer to where a scrollbar is usually placed.
7. Type ifconfig and press Enter to see your network interfaces: wired, wireless,
FireWire, lo (the loopback device), and so forth. They’re displayed with their
MAC addresses (in the “HWaddr” column) and currently assigned IP addresses
(in the “inet addr” column). Try the same command with -a, and observe the
difference in the output. Append the output of this command to your log file.
8. Navigate to the root directory by typing cd / and pressing Enter. Confirm that you’re
at the top of the directory tree by typing pwd and pressing Enter.
9. To identify the username you’re currently using, type whoami and press Enter.
10. To see a listing of all user accounts configured on the system, type sudo cat
/etc/passwd and press Enter, and then type the password and press Enter. The
output displays the contents of the user account configuration file, passwd. It contains the superuser account “root,” the regular user account you’re currently using,
and a long list of system accounts for system services, such as lp, sys, daemon, and
sync. For each account, you see the username, numeric user and group IDs, possibly
a formatted display name, the home directory (which is /root for the superuser), and
the standard command shell, which is usually /bin/bash for regular and root users.
11. To see just the information for your user account, type cat /etc/passwd j grep
user (replacing user with your own username) and press Enter.
12. Append the /etc/passwd file to your log file by typing cat /etc/passwd >>
~/my.log and pressing Enter. The /etc/passwd file doesn’t contain user
passwords, although it used to store hashed passwords. Because everyone can
read this file, storing even hashed passwords was considered a security risk, so
they were moved to the /etc/shadow file, which can be accessed only by the
root user.
13. To get a detailed listing of the /etc/shadow file, type ls -l /etc/shadow and
press Enter. If permission is denied, repeat this command preceded by sudo.
14. Type sudo cat /etc/shadow and press Enter, and then type the password and
press Enter. The file’s contents are shown, but only regular user accounts contain a
password hash. You should see this information for your user account.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining Linux File Structures
291
15. To append just the entry for your user account to your log file, type sudo cat
/etc/shadow j grep user >> ~/my.log (replacing user with your username)
and press Enter. This command redirects the output of cat as input to grep, which
leaves only the line containing your username, and then appends it to your log file.
You can have multiple j pipes in a single command but only one redirection to a file
(using > or >>) because the file is a like a dead end—there can be no output after it’s
redirected to a file.
16. Close the terminal window by typing exit and pressing Enter, and leave Ubuntu
running for the next activity.
Next, you examine deconstructing password hash values in the etc/shadow file.
The entries in /etc/shadow are separated by colons. The first field is the username, and
the second is the password hash, if available. (For more details, see www.cyberciti.biz/faq/
understanding-etcshadow-file/.) The remaining fields are numeric settings, including the
maximum time before a password must be changed. Take a look at a typical password
hash field:
$digit$ShortHashString$LongHashString
It begins with a $ symbol, followed by a digit representing the hashing algorithm (which is 6
for SHA-512). Next is another $ symbol followed by a short hash string, which is the
password salt, used to make password hashes different even if two users have the same password. Finally, there’s another $ symbol followed by a long hash string, which is the salted
password hash. Even though passwords aren’t stored in plaintext, two users having the same
password normally results in identical hashes, which could make cracking passwords easier.
In addition, without password salting, it’s possible for others to create rainbow tables
(discussed in more detail in Chapter 9) to look up passwords.
The salt and hash are stored in an encoded format with letters, numbers, dots, and slashes
that’s similar to base-64 encoding. Assuming the password hash field starts with $6$, meaning SHA-512 is being used, you can use the following command to find a salted password
hash, replacing ShortHashString and password with the information from your own
entry in the /etc/shadow file:
mkpasswd --method¼sha-512 --salt¼ShortHashString password
This command returns the salted password hash and is used internally by the OS to check
whether the correct password was entered. However, knowing how password hash values
are created is helpful in case you need to attempt cracking passwords.
File Structures in Ext4
Linux supports a wide range of file systems. The early standard was Second Extended File
System (Ext2), and then Third Extended File System (Ext3) replaced Ext2 in most Linux distributions. Its major difference from Ext2 was being a journaling file system, which has a
built-in file recovery mechanism used after a crash.
A few years later, Fourth Extended File System (Ext4) was introduced. Among other features,
it added support for partitions larger than 16 TB, improved management of large files, and
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
7
292
Chapter 7
offered a more flexible approach to adding file system features. Because these changes
affected the way the Linux kernel interacts with the file system, adoption of Ext4 was slower
in some Linux distributions, but it’s now considered the standard file system for most distributions. The Ubuntu version you used previously, for example, has an Ext4 partition at its
core, unless you select another file system during installation.
In UNIX and Linux, everything is considered a file, including disk drives, monitors, tape drives,
network interface cards, system memory, and directories. UNIX files are defined as objects,
which means a file, like an object in an object-oriented programming language, has properties
and methods (actions such as writing, deleting, and reading) that can be performed on it.
UNIX/Linux has four components defining the file system: boot block, superblock, inode
block, and data block. A block is the smallest disk allocation unit in the UNIX/Linux file system and can be 512 bytes and up; block size depends on how the disk volume is initiated.
The boot block contains the bootstrap code—instructions for startup. A UNIX/Linux computer has only one boot block, on the main hard disk.
The superblock contains vital information about the system and is considered part of the
metadata. It specifies the disk geometry and available space and keeps track of all inodes (discussed in more detail in the following section). The superblock also manages the file system,
including configuration information, such as block size for the drive, file system names,
blocks reserved for inodes, and volume name. Multiple copies of the superblock are kept in
different locations on the disk to prevent losing such important information.
Inode blocks contain the first data after the superblock. An inode is assigned to every file allocation unit. As files or directories are created or deleted, inodes are also created or deleted.
The link between inodes associated with files and directories controls access to those files or
directories.
The data block is where directories and files are stored on a disk drive. This location is linked
directly to inodes. As in Microsoft file systems, the Linux file system on a PC has 512-byte
sectors. A data block is equivalent to a cluster of disk sectors on a FAT or NTFS volume.
Blocks range from 1024 to 4096 bytes each on a Linux volume.
Inodes Inodes contain file and directory metadata and provide a mechanism for linking
data stored in data blocks. When a file or directory is created on a Linux file system, an inode
is assigned that contains the following information:
•
The mode and type of the file or directory
•
The number of links to a file or directory
•
The UID and GID of the file’s or directory’s owner
•
The number of bytes in the file or directory
•
The file’s or directory’s last access time and last modified time
•
The inode’s last file status change time
•
The block address for the file data
•
The indirect, double-indirect, and triple-indirect block addresses for the file data
•
Current usage status of the inode
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining Linux File Structures
•
The number of actual blocks assigned to a file
•
File generation number and version number
•
The continuation inode’s link
293
The only pieces of metadata not in an inode are the filename and path. Inodes contain modification, access, and creation (MAC) times, not filenames. An assigned inode has 13 pointers
that link to data blocks and other pointers where files are stored. Pointers 1 through 10 link
directly to data storage blocks in the disk’s data block and contain block addresses indicating
where data is stored on the disk. These pointers are direct pointers because each one is associated with one block of data storage.
As a file grows, the OS provides up to three layers of additional inode pointers. In a file’s
inode, the first 10 pointers are called indirect pointers. The pointers in the second layer are
called double-indirect pointers, and the pointers in the last or third layer are called tripleindirect pointers.
To expand storage allocation, the OS initiates the original inode’s 11th pointer, which links
to 128 pointer inodes. Each pointer links directly to 128 blocks located in the drive’s data
block. If all 10 pointers in the original inode are consumed with file data, the 11th pointer
links to another 128 pointers. The first pointer in this indirect group of inodes points to the
11th block. The last block of these 128 inodes is block 138.
The term “indirect inode” refers to the 11th pointer in the original
inode, which points to another group of inode pointers. In other
words, it’s linked indirectly to the original inode.
If more storage is needed, the 12th pointer of the original inode is used to link to another 128
inode pointers. From each of these pointers, another 128 pointers are created. This second
layer of inode pointers is then linked directly to blocks in the drive’s data block. The first
block these double-indirect pointers point to is block 139. If more storage is needed, the 13th
pointer links to 128 pointer inodes, each pointing to another 128 pointers, and each pointer
in this second layer points to a third layer of 128 pointers. File data is stored in these data
blocks, as shown in Figure 7-3.
All disks have more storage capacity than the manufacturer states. For example, a 240 GB
disk might actually have 240.5 GB free space because disks always have bad sectors.
Windows doesn’t keep track of bad sectors, but Linux does in an inode called the bad block
inode. The root inode is inode 2, and the bad block inode is inode 1. Some forensics tools
ignore inode 1 and fail to recover valuable data for cases. Someone trying to mislead an
investigator can access the bad block inode, list good sectors in it, and then hide information
in these supposedly “bad” sectors.
To find bad blocks on your Linux computer, you can use the badblocks command,
although you must log in as root to do so. Linux includes two other commands that supply
bad block information: mke2fs and e2fsck. The badblocks command can destroy valuable data, but the mke2fs and e2fsck commands include safeguards that prevent them from
overwriting important information.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
7
294
Chapter 7
Figure 7-3 Inode pointers in the Linux file system
ª Cengage Learningâ
Hard Links and Symbolic Links A hard link is a pointer that allows accessing the
same file by different filenames (Rute-Users-Guide/Linux Dictionary V 0.16, www.tldp.org/
LDP/Linux-Dictionary/html/index.html). The filenames refer to the same inode and physical
location on a drive. Originally, hard links were used so that people with different logins could
access the same physical file. If one person changed the file, the changes would be apparent
when another user opened the file.
Figure 7-4 shows three hard-linked files pointing to the same inode: 23509. You use the ln
command to create a hard link. The main requirement is that all files pointing to the same
inode have to be on the same physical drive, not on another volume.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining Linux File Structures
/usr/rorry/tracking.db
Inode
23509
295
/usr/john/mydatafile.db
/usr/diane/company.db
Figure 7-4 Hard-linked files with different filenames
ª 2016 Cengage Learningâ
To see files and their inode numbers, you use the ls -ia command. Inside each inode is
a field called link count that specifies the number of hard links. The link count for directories
is higher than for other file types. If two files have the same inode number, the link count is
two. If one file is deleted, the link count drops by one. When the hard link count drops to
zero, the file is effectively deleted. Most forensics tools, however, can retrieve these files.
To see the contents of a directory, you use the ls -a command. The first two items are .
(called “dot”), which refers to the directory, and .. (called “dot-dot”), which refers to the
parent directory (see Figure 7-5). Both dot and dot-dot count as links, so most directories
have at least two hard links. Every subdirectory has a dot-dot reference to the corresponding
parent directory; therefore, each one adds to the parent directory’s link count.
The dot indicating the
current directory
The dot-dot indicating the
parent directory
Figure 7-5 The ls -a command showing the dot and dot-dot notation
Source: www.ubuntu.com
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
7
296
Chapter 7
Symbolic links (also known as “soft links” or “symlinks”) are simply pointers to other files
and aren’t included in the link count. Unlike hard links, they can point to items on other
drives or other parts of the network; they simply need an absolute path. Symbolic links have
an inode of their own, which isn’t the same as the inode of the item they’re pointing to.
Unlike hard links, they depend on the continued existence of the destination they’re pointing
to, and they’re easier to identify on a running Linux system than hard links are. Unlike hard
links, which point to their destination with an inode number, symbolic links identify their
destination by name and path. If a name and path no longer exist, the symbolic link stops
working. You create symbolic links with the ln -s command.
To see how hard and symbolic links work, follow these steps:
1. Start Ubuntu, if necessary, and open a terminal window. Type ls -l and
press Enter.
2. The number in the second column shows the hard link count (see Figure 7-6).
Notice the number of hard links for the Music directory. Type cd Music and
press Enter. Create a subdirectory called PopTunes by typing mkdir PopTunes
and pressing Enter.
Hard link count
Figure 7-6 The ls -l command showing the hard link count
Source: www.ubuntu.com
3. Return to your home directory by typing cd and pressing Enter. Next, type
ls -l and press Enter, and notice that the link count for the Music directory
has increased.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Examining Linux File Structures
297
4. To create a hard link, first create a new file by typing touch originalfile
and pressing Enter. Then create a new subdirectory in the /tmp directory by
typing mkdir /tmp/chap07 and pressing Enter. Switch to your home directory
again, if necessary, and type ln originalfile /tmp/chap07/newfile and
press Enter.
5. Type ls -i and press Enter to see originalfile’s inode number. Change to the
/tmp/chap07 directory and repeat this command. Newfile should have the same
inode number as originalfile (see Figure 7-7).
Same inode
number
Figure 7-7 Comparing inode numbers for a hard link
Source: www.ubuntu.com
6. To create a symbolic link, switch to the /tmp directory, and type mkdir testsym
and press Enter to create a new subdirectory. Switch to this subdirectory, and
create two files by typing touch test1 test2 and pressing Enter. Finally,
create the symbolic link by typing ln -s /tmp/testsym mysym and
pressing Enter.
7. Type ls -1 mysym (using the numeral one, not a lowercase L, for the option
after the hyphen) and press Enter. The files you created in the testsym directory
are also in mysym. Finally, type ls -l mysym and press Enter. An arrow points
from mysym to the testsym directory, as shown in Figure 7-8, to indicate the
symbolic link.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
7
298
Chapter 7
Symbolic link
Figure 7-8 Creating a symbolic link
Source: www.ubuntu.com
8. Leave Ubuntu running and the terminal window open for the next activity.
Understanding Macintosh File Structures
The current Mac OS is Mac OS X, version 10.9, code-named Mavericks. Yosemite, version
10.10, is scheduled to be released October 2014. Other versions still in use include 10.6
(Snow Leopard), 10.7 (Lion), and 10.8 (Mountain Lion). Mac OS X is built on a core called
Darwin, which consists of a Berkeley Software Distribution (BSD) UNIX application layer
built on a Mach microkernel. Apple’s OSs have been developing since 1984 with the introduction of Apple System 1. In 1997, Apple introduced Mac OS 8, followed by Mac OS 9 and
then OS X. With OS X, Macintosh moved to the Intel processor and became UNIX based.
The newest version of Mac OS X, version 10.10 (code-named Yosemite), was released for beta testing in June 2014. You can find updated
information on it at https://www.apple.com/osx/preview/.
Before OS X, the Hierarchical File System (HFS) was used, in which files are stored in directories (folders) that can be nested in other directories. With Mac OS 8.1, Apple introduced
Extended Format File System (HFS+), which continues to be an optional format in Mac OS X.
The main difference between HFS and HFS1 is that HFS was limited to 65,536 blocks
(512 bytes per block) per volume, and HFS1 raised the number of blocks to more than
4 billion. Consequently, HFS1 supports smaller file sizes on larger volumes, resulting in more
efficient disk use. Mac OS X also supports the Unix File System (UFS), which isn’t covered in
this book.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding Macintosh File Structures
299
An Overview of Mac File Structures
In Mac, a file consists of two parts: a data fork, where data is stored, and a resource fork,
where file metadata and application information are stored (see Figure 7-9). Both forks contain the following essential information for each file:
•
Resource map
•
Resource header information for each file
•
Window locations
•
Icons
7
Figure 7-9 The resource fork and data fork in a Mac OS X file
ª Cengage Learningâ
The data fork typically contains data the user creates, such as text or spreadsheets. Applications, such as Microsoft Word or Excel, also read and write to the data fork. When you’re
working with an application file, the resource fork contains additional information, such as
menus, dialog boxes, icons, executable code, and controls. In the Mac OS, the resource or
data fork can be empty.
A volume is any storage medium used to store files. It can be all or part of the storage media
for hard disks; however, in Mac OS 9 and earlier, a volume on a floppy disk was always the
entire floppy. With larger disks, the user or administrator now defines a volume.
Volumes have allocation blocks and logical blocks. A logical block is a collection of data that
can’t exceed 512 bytes. When you save a file, it’s assigned to an allocation block, which is a
group of consecutive logical blocks. As volumes increase in size, one allocation block might
be composed of three or more logical blocks. Figure 7-10 shows the relationship between
these two types of blocks. If a file contains information, it always occupies one allocation
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
300
Chapter 7
Figure 7-10 Logical and allocation block structures
ª Cengage Learningâ
block. For example, if a data fork contains only 11 bytes of data, it occupies one allocation
block (512 bytes) on a disk, which leaves more than 500 bytes empty in the data fork.
The HFS and HFS1 file systems have two descriptors for the end of a file (EOF)—the logical
EOF and the physical EOF. The logical EOF is the actual ending of a file’s data, so if file B
has 510 bytes of data, byte 510 is the logical EOF. The physical EOF is the number of bytes
allotted on the volume for a file, so for file B, it’s byte 1023, as shown in Figure 7-11.
Figure 7-11 Logical EOF and physical EOF
ª Cengage Learningâ
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Understanding Macintosh File Structures
301
Mac reduces file fragmentation by using clumps, which are groups of contiguous allocation
blocks. As a file increases in size, it occupies more of the clump. Volume fragmentation is
kept to a minimum by adding more clumps to larger files.
For older HFS-formatted drives, the first two logical blocks, 0 and 1, on the volume (or disk)
are the boot blocks containing system startup instructions. Optional executable code for
system files can also be placed in boot blocks.
Older Mac OSs use the Master Directory Block (MDB) for HFS, which is the Volume Information Block (VIB) in HFS1. All information about a volume is stored in the MDB and
written to it when the volume is initialized. A copy of the MDB is also written to the nextto-last block on the volume to support disk utility functions. When the OS mounts a volume, some information from the MDB is written to a Volume Control Block (VCB), stored
in system memory. When a user no longer needs the volume and unmounts it, the VCB
is removed.
The copy of the MDB is updated when the extents overflow file or catalog increases in size.
The extents overflow file is used to store any file information not in the MDB or a VCB. The
catalog is the listing of all files and directories on the volume and is used to maintain relationships between files and directories on a volume.
Volume Bitmap, a system application, tracks each block on a volume to determine which
blocks are in use and which ones are available to receive data. Volume Bitmap has information about the blocks’ use but not about their content. Volume Bitmap’s size depends on the
number of allocated blocks for the volume.
File-mapping information is stored in two locations: the extents overflow file and the file’s
catalog entry. In earlier Mac versions, the B*-tree file system is also used to organize the
directory hierarchy and file block mapping. In this file system, files are nodes (records or
objects) containing file data. Each node is 512 bytes. The nodes containing actual file data
are called leaf nodes; they’re the bottom level of the B*-tree. The B*-tree also has the following nodes that handle file information:
•
The header node stores information about the B*-tree file.
•
The index node stores link information to previous and next nodes.
•
The map node stores a node descriptor and map record.
For more information on HFS and HFS1, see http://wiki.sleuthkit.org/
index.php?title¼HFS and https://developer.apple.com/library/mac/
documentation/Darwin/Reference/Manpages/man1/RezWack.1.html.
Forensics Procedures in Mac
Although understanding Linux file structures can help you learn about Mac file structures,
there are some differences between the Linux and Mac OS X file systems. For example, Linux
has the /home/username and /root directories. In Mac, the corresponding folders are
/users/username and /private/var/root. The /home directory exists in the Mac
OS, but it’s empty. In addition, Mac users have limited access to other user accounts’ files,
and the guest account is disabled by default. If it’s enabled, it has no password, and guest files
are deleted at logout.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
7
302
Chapter 7
For forensics procedures in Mac OS X, you must know where file system components are
located and how both files and file components are stored. Application settings are in three
formats: plaintext, plist files (which include plain XML plists and binary plists, which are
condensed XML), and the SQLite database. Plaintext files, of course, can be viewed in any
text editor. Plist files are preference files for installed applications on a system, usually stored
in /Library/Preferences. To view them, you use special editors, such as the one
available at the Apple Developer Web site (https://developer.apple.com) or PlistEdit Pro
(www.macupdate.com/app/mac/14363/plistedit-pro). To view the SQLite database, use the
SQLite Database Browser (http://sqlitebrowser.org).
Other files that might contain information useful for an investigation include the following:
•
/System/Library/CoreServices/SystemVersion.plist—Contains the OS
version.
•
/Library/Preferences/SystemConfiguration/NetworkInterfaces.
plist—Shows all existing network interfaces. If an interface has been used recently,
it’s listed in the /private/var/db/dhcpclient/leases directory.
•
/private/var/db/DirectoryService/flatfile.db—A list of users on a system;
used before Mac OS X v10.7 and is similar to the Linux/UNIX /etc/passwd file.
•
/private/var/db/dslocal/nodes/Default/users—Contains users’ plist files
in Mac OS X version after 10.7.
•
/private/var/db/shadow/hash—Contains account passwords.
FileVault, introduced with version 10.3, is used to encrypt and decrypt a user’s /users
directory. It has master keys and recovery keys, which research later proved could be
retrieved from RAM and used to crack encryption. In response to these security vulnerabilities, Mac improved FileVault by introducing FileVault2, which encrypts the whole disk with
128-bit AES encryption.
Other encrypted information you’re likely to find during an investigation is passwords. Since
Mac OS 8.6, keychains have been used to manage passwords for applications, Web sites,
and other system files (www.macworld.com/article/2013756/how-to-manage-passwordswith-keychain-access.html). You can find keychain files in a variety of places, including
/System/Library/Keychains and /Library/Keychains, and they can be useful to
show what applications and files require passwords. The Mac application Keychain Access
enables you to restore passwords.
You need to find deleted files in most investigations, too. In Mac OS X, deleted files are in the
Trashes folder. If a file is deleted at the command line, however, it doesn’t show up in the
trash, which is similar to the Recycle Bin in Windows.
Unlike Windows, Mac files retain their filenames in the trash. In addition, when you copy a file in Windows, the timestamp is reset. In Mac
OS X, the creation time is copied, so Mac timestamps are more
accurate.
Several vendors have software for examining the Mac OS X file system. In the following section,
you look at BlackBag Technologies (https://www.blackbagtech.com/software-products.html).
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Linux Forensics Tools
303
Another product for Mac forensics is SubRosaSoft MacForensicsLab (www.macforensicslab.com).
Other vendors have added the capability to analyze Mac file systems, such as ProDiscover
Forensic Edition and the freeware tools Sleuth Kit and Autopsy (www.sleuthkit.org). Sleuth
Kit is discussed in “Using Linux Forensics Tools” later in this chapter.
Mac Acquisition Methods To examine a Mac computer, you need to make an
image of the drive, using the same techniques described in Chapter 5. You should be aware
of some exceptions, however, caused by Mac design and engineering. (In addition, removing
the drive from a Mac Mini case is difficult, and attempting to do so without Apple factory
training could damage the computer. A MacBook Air poses similar problems, as you need
special Apple screwdrivers to open the case.) You need a Mac-compatible forensic boot
CD/DVD to make an image, which then must be written to an external drive, such as a
FireWire or USB drive. Larger Macs are constructed much like desktop PCs, making removal
of the hard drive easier.
BlackBag Technologies sells acquisition tools for OS 9 and OS X and offers a forensic boot CD
called MacQuisition for making an image of a Mac drive (see https://www.blackbagtech.com/
software-products/macquisition-2/macquisition.html). BlackBag Technologies has also written
a guide for forensic examination of Macs (www.macforensicslab.com/ProductsAndServices/
index.php?main page¼document general info &products id¼134). Although this guide is
older, it’s still useful.
After making an acquisition, the next step is examining the image of the file system with a
forensics tool. The tool you use depends on the image file’s format. For example, if you used
EnCase, FTK, or X-Ways Forensics to create an Expert Witness (.e0l) image, you must use
one of these tools to analyze the image. If you made a raw format image, you can use any of
the following tools:
•
BlackBag Technologies Macintosh Forensic Software (OS X only)
•
SubRosaSoft MacForensicsLab (OS X only)
•
Guidance Software EnCase
•
X-Ways Forensics
•
AccessData FTK
BlackBag Technologies Macintosh Forensic Software and SubRosaSoft MacForensicsLab
have a feature for disabling and enabling Disk Arbitration, which is a Mac OS X feature for
disabling and enabling automatic mounting when a drive is connected via a USB or FireWire
device (see www.appleexaminer.com). Being able to turn off the mount function in OS X
allows you to connect a suspect drive to a Mac without a write-blocking device.
Using Linux Forensics Tools
Learning how to use Linux forensics tools can come in handy when Windows tools don’t
work or you’re having trouble getting a Windows machine to boot. Several commercial and
freeware tools are available for analyzing UNIX and Linux file systems. Most commercial
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
7
304
Chapter 7
forensics tools, such as OSForensics, X-Ways Forensics, Guidance Software EnCase,
AccessData FTK, and ProDiscover Forensic Edition, can analyze Linux Ext2, Ext3, Ext4,
ReiserFS, and Reiser4 file systems. (ProDiscover Basic can analyze only FAT and NTFS file
systems.)
Freeware tools include Sleuth Kit and its Web browser interface, Autopsy Forensic Browser,
maintained by Brian Carrier (see www.sleuthkit.org). Sleuth Kit, previously called TASK, is
partially based on The Coroner’s Toolset (TCT) by Dan Farmer and Wietse Venema and
designed as a network analysis tool for investigating attackers.
The U.S. Air Force Office of Special Investigations and the Center for Information Systems
Security Studies and Research developed another specialized freeware tool called Foremost
(see http://foremost.sourceforge.net). Foremost is a carving tool that can read many image
file formats, such as raw and Expert Witness. It has a configuration file, foremost.conf,
listing the most common file headers, footers, and data structures. If a file format isn’t
included in this file, it can be added by using a hex editor to determine the new format’s
header and footer values and a text editor to update the file. This file is typically in the
/usr/local/etc directory and contains instructions on updating it. If your installation
is different, read the makefile script in the Foremost tarball to see how the current version is installed. A tarball is a highly compressed data file containing one or more files
or directories and their contents. It’s similar to Windows zip utilities and typically has a
.tar or .gz extension.
Installing Sleuth Kit and Autopsy
Sleuth Kit and Autopsy can be installed on 32-bit or 64-bit Windows versions, and version 2
can be installed in Linux or Mac OS X. You can find current and past versions of Sleuth Kit
and Autopsy Forensic Browser at www.sleuthkit.org.
Older versions of Sleuth Kit and Autopsy are available at Web sites listed
on Sleuth Kit’s main page. The RPM Package Manager utility makes
installing these tools in Red Hat and Fedora Linux much easier. Several
other Linux distributions have tools for installing RPM packages. Check
their documentation to see how they handle RPM packages.
In Linux, Sleuth Kit must be installed before Autopsy Forensic Browser,
or Autopsy isn’t installed correctly. In Windows, however, the order
of installation isn’t critical. In addition, when you’re running Autopsy
Forensic Browser in Mac or Linux, you must preface all commands
with sudo.
To install Sleuth Kit and Autopsy Forensic Browser in Ubuntu 14.04, you need root user
privileges. Follow these steps:
1. If necessary, start Ubuntu and open a terminal window.
2. To install Sleuth Kit, type sudo apt-get install sleuthkit and hit Enter,
and then install Autopsy by typing sudo apt-get install autopsy and
pressing Enter.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Linux Forensics Tools
305
3. To confirm that you’re in your home directory, type pwd and press Enter. Next, create
the evidence locker for storing files by typing mkdir Documents/Evidence Locker
and pressing Enter.
4. To start Autopsy and let it know where to store files, type autopsy -d
/home/username/Documents/Evidence Locker (see Figure 7-12) and
press Enter.
7
Figure 7-12 Starting Autopsy in Linux
Source: www.sleuthkit.org
5. Right-click the URL http://localhost:9999/autopsy shown in the terminal window and
click Open Link. Figure 7-13 shows the Autopsy main window.
Figure 7-13 The Autopsy main window
Source: www.sleuthkit.org
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
306
Chapter 7
If you see a warning message at the top stating that JavaScript is
enabled, you have to reconfigure your browser to disable it. After
reconfiguring the browser, you might have to exit and restart. If the
Autopsy terminal session is still running, simply paste the Autopsy URL
into the Address text box again.
6. Leave Autopsy running and your Web browser open for the next activity.
Examining a Case with Sleuth Kit and Autopsy In this section, you use
Sleuth Kit and Autopsy Forensic Browser to examine an older Linux file system. In digital
forensics, sometimes you have to reevaluate cases that are several years old, and this activity
gives you a chance to do that. Before starting the examination, copy the GCFI-LX.00n (with
n representing a number from 1 to 5) image files from the DVD (or your work folder) to the
evidence locker you set up in the previous activity. Autopsy uses the evidence locker to save
results from examinations. To start the examination, follow these steps:
1. In Autopsy’s main window, click the New Case button shown previously in Figure 7-13.
When the Create a New Case dialog box opens, enter InChap7 for the case name (see
Figure 7-14), a description (optional), and your name, and then click the New Case
button to continue.
Figure 7-14 The Create a New Case dialog box
Source: www.sleuthkit.org
2. In the Creating Case dialog box, click Add Host to continue. In the Add a New Host
dialog box, enter TestUbuntu12-04 for the hostname (see Figure 7-15), and then click
Add Host.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Using Linux Forensics Tools
307
7
Figure 7-15 The Add a New Host dialog box
Source: www.sleuthkit.org
3. In the Adding host dialog box, click Add Image to continue. In the Open Image dialog
box, click Add Image File.
4. In the Add a New Image dialog box, type the complete path to the evidence locker in
the Location text box, click the Partition and Move option buttons, and then click
Next. (Remember that Linux commands are case sensitive. If you enter a lowercase
filename and the filename is uppercase, Autopsy can’t find and load the file.)
If you don’t click Partition in Step 4, the image is read as raw data,
and file and directory structures aren’t visible to Autopsy.
If you have multiple segment volumes that are sequentially numbered
or lettered (the dd command with the split option without the -d
switch), use an asterisk as the extension (for example, GCFI-LX.*)
so that all segments are read sequentially.
5. In the Split Image Confirmation dialog box, verify that all images are correctly loaded;
if they are, click Next. If not, click Cancel. (If this data is incorrect, it’s probably
caused by an error in the pathname to the evidence locker or image files.)
6. In the Image File Details section, click the Calculate the hash value for this image
option button, and then click Add. In the Calculating MD5 message box, click OK.
7. In the “Select a volume to analyze or add a new image file” dialog box, click
Analyze and then Keyword Search to start a search for keywords of interest to
the investigation.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
308
Chapter 7
8. In the Keyword Search of Allocated and Unallocated Space dialog box, type the name
martha in the text box, and then click Search.
9. When the search is finished, Autopsy displays a summary of the search results. To see
detailed search results, click the link to results link at the upper left.
10. Examine the search results by scrolling through the left pane, and then click the
Fragment 236019 “Ascii” link to view details of the search. Repeat this examination
by clicking other ASCII and Hex links for the remaining hits. When you’re finished
examining the search hits, close the Searching for ASCII and Searching for Unicode
dialog box to return to the “Select a volume to analyze or add a new image file”
dialog box. Exit Autopsy, and log off Ubuntu.
Many investigators use a Windows machine as their main forensic workstation, so Autopsy
now offers a Windows version for both 32-bit and 64-bit systems. Follow these steps to try
this version:
1. Create a subfolder of your work folder called Autopsy. Start a Web browser, if
necessary, and go to www.sleuthkit.org. Download the 32-bit or 64-bit .msi file
for the Windows version of Autopsy.
2. On your Windows workstation, start Autopsy. Figure 7-16 shows the opening
window. Click Create New Case.
Figure 7-16 The Autopsy for Windows opening window
Source: www.sleuthkit.org
3. In the New Case Information dialog box, type InChap7Windows in the Case
Name text box. Click the Browse button next to the Base Directory text box, navigate
to and click the Autopsy subfolder you created, and click Select. Click Next and
then Finish.
4. In the Add Data Source dialog box, click the Browse button next to the “Browse for
an image” text box. Navigate to where you downloaded the M57 case files previously,
click charlie-work-usb-2009-12-11.E01, and click Open. Click Next.
5. Keep the default settings in the Configure Ingest Modules dialog box. Click Next and
then Finish. The workspace should be displayed. Click to expand the image file in the
left pane, and review its contents in the right pane (see Figure 7-17).
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Chapter Summary
309
7
Figure 7-17 Charlie’s USB drive open in Autopsy
Source: www.sleuthkit.org
6. Click File, Exit from the menu to exit Autopsy.
With Sleuth Kit and Autopsy, you can conduct additional analysis and produce other output
files in subdirectories of the evidence locker. You can then use these files in a narrative report,
as explained in Chapter 16.
Chapter Summary
䊏
UNIX was created to be a multiuser, multithreaded, secure OS. The Open Group was
formed as a neutral standards consortium that determines and certifies when an OS
meets UNIX requirements.
䊏
The Linux kernel is usually packaged with other software components, such as a GUI
and applications. The most widely used distributions include Ubuntu (a Debian-based
OS), Debian, Red Hat, OpenSUSE, and Slackware.
䊏
Linux supports a wide range of file systems. The most recent, Ext4, added support for
partitions larger than 16 TB, improved management of large files, and offered a more
flexible approach to adding file system features.
䊏
UNIX and Linux have four components defining the file system: boot block, superblock, inode block, and data block. In addition, an inode is assigned to each file
allocation unit that contains file and directory metadata (except the filename and path)
and provides a mechanism for linking data stored in data blocks.
䊏
In the Linux file system, a hard link is a pointer that allows accessing the same file by
different filenames, which refer to the same inode and physical location on the drive.
Symbolic links are pointers to other files; they can point to items on other drives or
other parts of the network and don’t affect the link count.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
310
Chapter 7
䊏
Before Mac OS X, the file systems HFS and HFS1 were used. The main difference
between them is that HFS was limited to 65,536 blocks (512 bytes per block) per
volume, and HFS1 raised the number of blocks to more than 4 billion. Consequently,
HFS1 supports smaller file sizes on larger volumes, resulting in more efficient disk use.
䊏
In Mac, a file consists of two parts: a data fork, where data is stored, and a resource
fork, where file metadata and application information are stored.
䊏
A volume is any storage medium used to store files. Volumes have allocation blocks
and logical blocks. When you save a file, it’s assigned to an allocation block, which is
a group of consecutive logical blocks. Mac reduces file fragmentation by using clumps,
which are groups of contiguous allocation blocks.
䊏
Plist files, which are preference files for installed applications on a Mac system, can be
useful sources of information for a forensics investigation.
䊏
The biggest challenge in acquiring images from Mac systems is often physical access to
the drive. With many Mac devices, special tools and training from Apple are needed.
䊏
Linux forensics tools are often freeware, so forensics investigators can use them to help
keep costs down. Tools such as Sleuth Kit and Autopsy are commonly used.
Key Terms
allocation block In the Mac file system, a group of consecutive logical blocks assembled in
a volume when a file is saved. See also logical block.
B*-tree A Mac file that organizes the directory hierarchy and file block mapping for File
Manager. Files are represented as nodes (objects); leaf nodes contain the actual file data.
bad block inode In the Linux file system, the inode that tracks bad sectors on a drive.
boot block A block in the Linux file system containing the bootstrap code used to start the
system.
catalog An area of the Mac file system used to maintain the relationships between files and
directories on a volume.
clumps In the Mac file system, groups of contiguous allocation blocks used to keep file
fragmentation to a minimum.
data block A block in the Linux file system where directories and files are stored on a drive.
data fork The part of a Mac file containing the file’s actual data, both user-created data and
data written by applications, as well as resource map and header information, window
locations, and icons. See also resource fork.
double-indirect pointers The inode pointers in the second layer or group of an OS. See also
inodes.
Extended Format File System (HFS+) File system used by Mac OS 8.1 and later. HFS1
supports smaller file sizes on larger volumes, resulting in more efficient disk use.
extents overflow file A file in HFS and HFS1 that’s used by the catalog to coordinate file
allocations to a volume when the list of a file’s contiguous blocks becomes too long. Any file
extents not in the MDB or a VCB are also contained in this file. See also catalog, Master
Directory Block (MDB), and Volume Control Block (VCB).
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Key Terms
311
Fourth Extended File System (Ext4) A Linux file system that added support for partitions
larger than 16 TB, improved management of large files, and offered a more flexible approach
to adding file system features.
hard link In the Linux file system, a pointer that allows accessing the same file by different
filenames, which refer to the same inode and physical location on the drive.
header node A node that stores information about the B*-tree file. See also B*-tree.
Hierarchical File System (HFS) An older Mac OS file system, consisting of directories and
subdirectories that can be nested.
index node A B*-tree node that stores link information to the previous and next nodes.
See also B*-tree.
indirect pointers The inode pointers in the first layer or group of an OS. See also inodes.
inode blocks Blocks in the Linux file system that contain the first data after the superblock
and consist of a grouping of inodes. See also inodes.
inodes A key part of the Linux file system, these information nodes contain descriptive file or
directory data, such as UIDs, GIDs, modification times, access times, creation times, and file
locations.
keychains A Mac feature used to track a user’s passwords for applications, Web sites, and
other system files.
link count A field in each inode that specifies the number of hard links. See also hard link.
logical block In the Mac file system, a collection of data that can’t exceed 512 bytes.
Logical blocks are assembled in allocation blocks to store files in a volume. See also
allocation block.
logical EOF In the Mac file system, the actual ending of a file’s data.
map node A B*-tree node that stores a node descriptor and map record. See also B*-tree.
Master Directory Block (MDB) On older Mac systems, the location where all volume
information is stored. A copy of the MDB is kept in the next-to-last block on the volume.
Called the Volume Information Block (VIB) in HFS1.
physical EOF In the Mac file system, the number of bytes allotted on a volume for a file.
plist files In Mac, preference files for installed applications on a system.
resource fork The part of a Mac file containing file metadata and application information,
such as menus, dialog boxes, icons, executable code, and controls. Also contains resource
map and header information, window locations, and icons. See also data fork.
Second Extended File System (Ext2) An early Linux file system.
superblock A block in the Linux file system that specifies and keeps track of the disk
geometry and available space and manages the file system.
symbolic links Pointers to other files; they can point to items on other drives or other parts
of the network and don’t affect the link count. See also hard link.
tarball A highly compressed data file containing one or more files or directories and their
contents.
Third Extended File System (Ext3) A Linux file system that made improvements to Ext2, such
as adding journaling as a built-in file recovery mechanism.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
7
312
Chapter 7
triple-indirect pointers The inode pointers in the third layer or group of an OS. See also
inodes.
Volume Control Block (VCB) An area of the Mac file system containing information from the
MDB. See also Master Directory Block (MDB).
Review Questions
1. Explain the differences in resource and data forks used in the Mac OS.
2. Which of the following is the main challenge in acquiring an image of a Mac system?
(Choose all that apply.)
a. Most commercial software doesn’t support Mac.
b.
Vendor training is needed.
c.
Macs are incompatible with most write-blockers.
d.
You need special tools to remove drives from a Mac system or open its case.
3. To recover a password on a Mac system, which tool do you use?
a. Finder
b.
PRTK
c.
Keychain Access
d.
Password Access
4. What are the major improvements in the Linux Ext4 file system?
5. How does the Mac OS reduce file fragmentation?
6. Linux is the only OS that has a kernel. True or False?
7. Hard links work in only one partition or volume. True or False?
8. Which of the following Linux system files contains hashed passwords for the local system?
a. /var/log/dmesg
b.
/etc/passwd
c.
/var/log/syslog
d.
/etc/shadow
9. Which of the following describes the superblock’s function in the Linux file system?
(Choose all that apply.)
a. Stores bootstrap code
b.
Specifies the disk geometry and available space
c.
Manages the file system, including configuration information
d.
Contains links between inodes
10. What’s the Disk Arbitration feature used for in Mac OS X?
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Review Questions
313
11. In Linux, which of the following is the home directory for the superuser?
a. home
b.
root
c.
super
d.
/home/superuser
12. Which of the following certifies when an OS meets UNIX requirements?
a. IEEE
b.
UNIX Users Group
c.
The Open Group
d.
SUSE Group
13. On most Linux systems, current user login information is in which of the following
locations?
a. /var/log/dmesg
b.
/var/log/wmtp
c.
/var/log/usr/
d.
/var/log/utmp
14. Hard links are associated with which of the following?
a. Dot notation
b.
A specific inode
c.
An absolute path to a file
d.
Hidden files
15. Which of the following describes plist files? (Choose all that apply.)
a. You must have a special editor to view them.
b.
They’re found only in Linux file systems.
c.
They’re preference files for applications.
d.
They require special installers.
16. Data blocks contain actual files and directories and are linked directly to inodes. True or
False?
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
7
314
Chapter 7
Hands-On Projects
Create a WorknChap07nProjects folder on your system before starting the projects; it’s
referred to as your “work folder” in steps. All the data files you use in these projects are from
previous chapters.
Hands-On Project 7-1
In this project, you explore another free Linux forensics tool. The Digital Evidence and Forensics Toolkit (DEFT) was created at the University of Bologna,
Italy.
1. Start a Web browser, if necessary, and go to www.deftlinux.net.
Download the DEFT ISO file and the user’s manual. Use the ISO file
to create a bootable DVD. (You aren’t installing it on your hard drive.
You might need to change the BIOS to boot from the CD/DVD drive.)
2. Start DEFT. The opening window should look similar to Figure 7-18.
Click Start, DEFT.
Figure 7-18 The opening window in DEFT
Source: DEFT Linux, www.deftlinux.net
3. Open the MountManager tool, and take a screenshot of this window for
your report. In the DEFT 8 - Warning! message box, click I know what I’m
doing to continue. Next, click Start, DEFT. Point to Hashing, and click
Dhash2. Make a note of the types of hashes that are available, and then
close this tool.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Hands-On Projects
315
4. Click the Autopsy icon to open the Autopsy Forensic Browser window and
the text interface. Take a screenshot of these windows, and then exit both.
5. Click the Digital Forensics Framework (DFF) icon. Examine its interface to
get an idea of what functions it has. If you have time, go to its Web site to
learn more about it.
6. Finally, click the GHex icon. This tool is a simple hex and binary editor.
Examine its interface, and take a screenshot.
7. Write a one- to three-page paper explaining how this tool could be used in
the field, and include your screenshots.
Hands-On Project 7-2
The purpose of this project is to become more familiar with the Linux version
of Sleuth Kit and Autopsy. The best way to learn a tool, especially one that
isn’t well documented, is to explore its functions. You’re encouraged to work
in teams for this project and share your findings with other students. For this
project, you convert the image file GCFI-datacarve-FAT.eve from
Chapter 3 to a raw dd image by using ProDiscover Basic, and then analyze it
with Sleuth Kit and Autopsy. You need the following:
• A PC running Windows with ProDiscover Basic installed
• A Linux or UNIX system with Sleuth Kit and Autopsy installed
• Disk storage of at least 200 MB to convert the .eve file to a dd file
Follow these steps:
1. Start ProDiscover Basic with the Run as administrator option. To convert
the GCFI-datacarve-FAT.eve file to GCFI-datacarve-FAT.dd on
a PC, click Tools, Image Conversion Tools from the menu and then click
Convert ProDiscover Image to “DD”. In the Convert ProDiscover Image to
“DD” Image dialog box, click the Browse button next to Source ProDiscover
Image, navigate to and click the location in your work folder where you saved
GCFI-datacarve-FAT.eve, and then click Open. Click OK, and then exit
ProDiscover Basic.
2. Copy the converted file to your Linux virtual machine with Sleuth Kit
and Autopsy installed. Start Sleuth Kit and Autopsy. In the main
window, click New Case. In the Create a New Case dialog box, fill in
your information (using GCFI-datacarve-FAT for the case name), and then
click New Case.
3. In the Creating Case dialog box, click Add Host, and in the Add a New
Host dialog box, enter your information, and click Add Host.
4. In the Adding host dialog box, click Add Image to continue. In the Open
Image dialog box, click Add Image File. In the Add a New Image dialog
box, type the full pathname and the GCFI-datacarve-FAT.dd image
filename in the Location text box, click the Partition option button, click
the Copy option button for the import method, and then click Next.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
7
316
Chapter 7
5. In the Image File Details section, click Add, and in the Testing partitions
dialog box, click OK. In the “Select a volume to analyze or add a new
image file” dialog box, click the Analyze button.
6. In the Analysis dialog box, click File Analysis, and then click
Generate MD5 List of Files. In the MD5 results window, save the list
as GCFI-datacarve-FAT-MD5.txt in your work folder, and close
the MD5 results window.
7. Next, in the Analysis dialog box, click File Type, click Sort Files by
Type, and then click OK. When the analysis is finished, print the Results
Summary frame of the Web page.
8. Click Image Details, and in the General File System Details dialog box,
print the frame containing the results.
9. Write a report describing the information each function asks for and
what information it produces so that you can begin building your own
user manual for this tool. Leave Sleuth Kit and Autopsy running for the
next project.
Hands-On Project 7-3
This project is a continuation of Hands-On Project 7-2, using Sleuth Kit and
Autopsy. First, convert the image files C1Prj01.eve and C1Prj04.eve
from Chapter 1 to raw dd images in ProDiscover Basic. Second, use Sleuth Kit
and Autopsy to perform the same tasks described in Hands-On Project 7-2 for
these two image files. When examining these image files, compare the results
with your findings in Hands-On Project 7-2, and write a brief report on any
similarities or differences to continue adding to your user manual.
Case Projects
Case Project 7-1
Research and compare forensics tools that can examine Mac, iPod, and iPhone
devices. Create a table listing the features they have in common, differences in
functions, and price. Write a short paper stating which one you would choose
if you were an investigator for a small firm, and explain why.
Case Project 7-2
This chapter introduced Autopsy for Windows, which is freeware. Compare it
with ProDiscover Basic and another free tool of your choice. Describe how
each tool performs in Linux based on research you do using blogs, user groups,
and user manuals.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
chapter
8
Recovering
Graphics
Files
After reading this chapter and completing
the exercises, you will be able to:
• Describe types of graphics file formats
• Explain types of data compression
• Explain how to locate and recover graphics files
• Describe how to identify unknown file formats
• Explain copyright issues with graphics
317
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
318
Chapter 8
Many digital forensics investigations involve graphics, especially those downloaded
from the Web and circulated via e-mail. To examine and recover graphics files, you need
to understand the basics of computer graphics, including file characteristics, common file
formats, and compression methods for reducing file size. This chapter begins with an overview of computer graphics and data compression, and then explains how to locate and
recover graphics files based on information stored in file headers. You learn how to identify
and reconstruct graphics file fragments, analyze graphics file headers, and repair damaged
file headers.
This chapter also explores tools for viewing graphics files you recover and discusses two
issues related to computer graphics: steganography and copyrights. Steganography involves
hiding data, including images, in files. Copyrights determine the ownership of media, such as
images downloaded from a Web site, and the right to use media.
Recognizing a Graphics File
Graphics files contain digital photographs, line art, three-dimensional images, text data converted to images, and scanned replicas of printed pictures. You might have used a graphics
program, such as Microsoft Paint, Adobe Photoshop, or Gnome GIMP, to create or edit an
image. A graphics program creates one of three types of graphics files: bitmap, vector, and
metafile. Bitmap images are collections of dots, or pixels, in a grid format that form a
graphic. Vector graphics are based on mathematical instructions that define lines, curves,
text, ovals, and other geometric shapes. Metafile graphics are combinations of bitmap and
vector images.
You can use two types of programs to work with graphics files: graphics editors and image
viewers. You use graphics editors to create, modify, and save bitmap, vector, and metafile
graphics. You use image viewers to open and view graphics files, but you can’t change their
contents. When you use a graphics editor or an image viewer, you can open a file in one of
many graphics file formats, such as BMP, GIF, and JPEG. Each format has different qualities,
including the amount of color and compression it uses. If you open a graphics file in a
graphics editor that supports multiple file formats, you can save the file in another file format.
However, converting graphics files in this way can change the image quality, as you see in a
hands-on project at the end of this chapter.
Understanding Bitmap and Raster Images
Bitmap images store graphics information as grids of pixels, short for “picture elements.”
Raster images are also collections of pixels, but they store pixels in rows to make images easy
to print. In most cases, printing an image converts (rasterizes) it to print pixels line by line
instead of processing the complete collection of pixels.
A bitmap’s image quality on a monitor is governed by resolution, which determines the
amount of detail that’s displayed. Resolution is related to the density of pixels onscreen and
depends on a combination of hardware and software. Monitors can display a range of resolutions; the higher the resolution, the sharper the image. Computers also use a video card containing a certain amount of memory for displaying images. The more advanced the video
card’s electronics and the more memory it has, the more detailed instructions it can accept,
resulting in higher-quality images.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Recognizing a Graphics File
319
For example, the monitor and video card on a Windows computer might support a 4096 3
2160 resolution, which means displaying 4096 pixels horizontally and 2160 pixels vertically.
Because a bitmap image is defined by pixel size, high-resolution images use smaller pixels
than low-resolution images do.
Software also contributes to image quality. Software includes drivers, which are coded
instructions that set a video card’s display parameters, and programs used to create, modify,
and view images. With some programs, such as IrfanView (www.irfanview.com), you can
view many types of images; with other programs, you can view or work with only the
graphics files they create. Digital graphics professionals use programs that support high resolutions to have more control over the display of bitmap images. However, bitmaps, especially
those with low resolution, usually lose quality when you enlarge them.
Another setting that affects image quality is the number of colors the monitor displays.
Graphics files can have different amounts of color per pixel, but each file must support colors
with bits of space. The following list shows the number of bits per colored pixel:
•
1 bit ¼ 2 colors
•
4 bits ¼ 16 colors
•
8 bits ¼ 256 colors
•
16 bits ¼ 65,536 colors
•
24 bits ¼ 16,777,216 colors
•
32 bits ¼ 4,294,967,296 colors
Bitmap and raster files use as much of the color palette as possible. However, when you save
a bitmap or raster file, the resolution and color might change, depending on the colors in the
original file and whether the file format supports these colors.
Understanding Vector Graphics
Vector graphics, unlike bitmap and raster images, use lines instead of dots to make up an image.
A vector file stores only the calculations for drawing lines and shapes; a graphics program converts these calculations into an image. Because vector files store calculations, not images, they
are generally smaller than bitmap files, thereby saving disk space. You can also enlarge a vector
graphic without affecting image quality—to make an image twice as large, a vector graphics
program, such as CorelDRAW and Adobe Illustrator, computes the image mathematically.
Understanding Metafile Graphics
Metafile graphics combine raster and vector graphics and can have the characteristics of both
file types. For example, if you scan a photograph (a bitmap image) and then add text or
arrows (vector drawings), you create a metafile graphic. Although metafile graphics have the
features of both bitmap and vector files, they share the limitations of both. For example, if
you enlarge a metafile graphic, the area created with a bitmap loses some resolution, but the
vector-formatted area remains sharp and clear.
Understanding Graphics File Formats
Graphics files are created and saved in a graphics editor, such as Microsoft Paint, Adobe
Freehand MX, Adobe Photoshop, or Gnome GIMP. Some graphics editors, such as Freehand
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
8
320
Chapter 8
MX, work only with vector graphics, and some programs, such as Photoshop, work
with both.
Most graphics editors enable you to create and save files in one or more of the standard
graphics file formats. Standard bitmap file formats include Portable Network Graphic (.png),
Graphics Interchange Format (.gif), Joint Photographic Experts Group (.jpg or .jpeg),
Tagged Image File Format (.tif or .tiff), and Windows Bitmap (.bmp). Standard vector
file formats include Hewlett-Packard Graphics Language (.hpgl) and AutoCad (.dxf).
Nonstandard graphics file formats include less common formats, such as Targa (.tga) and
Raster Transfer Language (.rtl); proprietary formats, such as Photoshop (.psd), Illustrator
(.ai), and Freehand (.fh11); newer formats, such as Scalable Vector Graphics (.svg); and
formats for old or obsolete formats, such as Paintbrush (.pcx). Because you can open standard graphics files in most or all graphics programs, they are easier to work with in a digital
forensics investigation. If you encounter files in nonstandard formats, you might need to rely
on your investigative skills to identify the file as a graphics file, and then find the right tools
for viewing it.
To determine whether a file is a graphics file and to find a program for viewing a nonstandard graphics file, you can search the Web or consult a dictionary Web site. For example,
suppose you find a file with a .tga extension during an investigation. None of the programs
on your forensic workstation can open the file, and you suspect it could provide crucial evidence. To learn more about this file format, see www.garykessler.net/library/file sigs.html, or
follow these steps:
1. Start your Web browser, and go to www.webopedia.com.
2. Type tga in the “Enter a term” text box, and click Search. Webopedia lists links to
additional Web pages describing the .tga file format.
3. In the Webopedia search results Web page, click the Data Format and File Extensions:
T Web link, www.webopedia.com/quick ref/fileextensionst.asp.
4. Scroll down until you find a definition of this format, and write it down. When you’re
finished, exit your Web browser.
Understanding Digital Camera File Formats
Digital cameras’ popularity has had quite an impact on digital forensics because witnesses or
suspects can create their own digital photos. As a digital forensics investigator, you might need
to examine a digital photo created by a witness to an accident, for example. Crimes such as
child pornography might involve hundreds of digital photos of alleged victims, and knowing
how to analyze the data structures of graphics files can give you additional evidence for a case.
In addition, knowing how digital photos are created and how they store unique information
can contribute to your credibility when presenting evidence. Most, if not all, digital cameras
produce digital photos in raw or Exif format, described in the following sections.
Examining the Raw File Format Referred to as a digital negative, the raw file
format is typically used on many higher-end digital cameras. A camera performs no enhancement processing—hence the term “raw” for this format. Sensors in a digital camera simply
record pixels on the memory card. One advantage of this format is that it maintains the best
picture quality.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Recognizing a Graphics File
321
From a digital forensics perspective, the biggest disadvantage of the raw file format is that it’s
proprietary, and not all image viewers can display these formats. To view a raw graphics file,
you might need to get the viewing and conversion software from the camera manufacturer.
Each manufacturer has its own program with an algorithm to convert raw data to other
standard formats, such as JPEG or TIF. The process of converting raw picture data to
another format is called demosaicing.
For more information on raw format images, see http://helpx.adobe.com/
photoshop/digital-negative.html.
Examining the Exchangeable Image File Format Most digital cameras use
the Exchangeable Image File (Exif) format to store photos. The Japan Electronics and Information Technology Industries Association (JEITA) developed it as a standard for storing metadata
in JPEG and TIF files (see http://home.jeita.or.jp/tsc/std-pdf/CP3451C.pdf). When a digital photo
is taken, information about the camera (such as model, make, and serial number) and settings
(such as shutter speed, focal length, resolution, date, and time) are stored in the graphics
file. Most digital cameras store graphics files as Exif JPEG files. In addition, if the camera
has GPS capability, the latitude and longitude location data might be recorded in the Exif section
of the picture file. Location data stored in digital images is discussed in more detail in Chapter 12.
Because the Exif format collects metadata, investigators can learn more about the type of
digital camera and the environment in which photos were taken. Viewing an Exif JPEG
file’s metadata requires special programs, such as Exif Reader (www.takenet.or.jp/ryuuji/
minisoft/exifread/english/), IrfanView (www.irfanview.com), or ProDiscover, which has a
built-in Exif viewer.
Originally, JPEG and TIF formats were designed to store only digital photo data. Exif is an
enhancement of these formats that modifies the beginning of a JPEG or TIF file so that metadata can be inserted. In the similar photos in Figure 8-1, the one on the left is an Exif JPEG
file, and the one on the right is a standard JPEG file.
Exif picture file
JPEG picture file
Figure 8-1 Similar Exif and JPEG photos
ª 2016 Cengage Learningâ
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
8
322
Chapter 8
Figure 8-2 shows the differences between file headers in Exif and standard JPEG files.
Sawtoothmt.jpg is an Exif file, and Sawtoothmtn.jpg is a standard JPEG file. The first
160 (hexadecimal 0x9F) bytes are displayed for both files.
JPEG file label types
Offset 6
Offset 2
Offset 0
Figure 8-2 Differences in Exif and JPEG file header information
Courtesy of X-Ways AG, www.x-ways.net
All JPEG files, including Exif, start from offset 0 (the first byte of a file) with hexadecimal FFD8. The current standard header for regular JPEG files is JPEG File Interchange
Format (JFIF), which has the hexadecimal value FFE0 starting at offset 2. For Exif
JPEG files, the hexadecimal value starting at offset 2 is FFE1. In addition, the hexadecimal values at offset 6 specify the label name (refer to Figure 8-2). For all JPEG files,
the ending hexadecimal marker, also known as the end of image (EOI), is FFD9 (see
Figure 8-3).
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Recognizing a Graphics File
323
JPEG file EOI marker
8
Figure 8-3 EOI marker FFD9 for all JPEG files
Courtesy of X-Ways AG, www.x-ways.net
With tools such as ProDiscover and Exif Reader, you can extract metadata as evidence for
your case. As you can see in Figure 8-4, ProDiscover shows that the picture was taken on
September 11, 2013, at 1:09 a.m. You might have noticed in Figure 8-1 that there’s a lot of
sunlight in the photos, but the metadata shows the time of day as 1:09 a.m., when sunlight is
unlikely.
As in any digital forensics investigation, determining date and time for a file is important.
Getting this information might not be possible, however, for a variety of reasons, such as suspects losing cameras after transferring photo files to their computers. You should list this type
of evidence as subjective in your report because intentional and unintentional acts make date
and time difficult to confirm. For example, suspects could alter a camera’s clock intentionally
to record an incorrect date and time when a picture is taken. An unintentional act could be
the battery or camera’s electronics failing, for example, which causes an incorrect date and
time to be recorded. When you’re dealing with date and time values in Exif metadata, always
look for corroborating information, such as where the picture was taken or whether the
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
324
Chapter 8
Camera-recorded date and time of photo
Figure 8-4 ProDiscover displaying metadata from an Exif JPEG file
Courtesy of Technology Pathways, LLC
device is set to Coordinated Universal Time (abbreviated as UTC), to help support what you
find in metadata.
For example, the photograph in Figure 8-1 was taken in Sante Fe, New Mexico, on September 10,
2013. If the camera’s date and time had been set to UTC, you need to adjust for local
time. In September, Sante Fe’s local time is mountain daylight saving (MDT), which is -6 hours
from UTC time. So the actual local time might be 7:09 p.m. MDT. Because 7:09 p.m. is early
evening, you should determine when sunset occurred on that date by using online tools,
such as Time and Date (www.timeanddate.com/worldclock/sunrise.html) or SunriseSunset
(www.sunrisesunset.com/sun.html). The Time and Date Web site shows that sunset for this
location and time happened at 7:18 p.m. If the camera is set to 7:09 p.m. local time, you might
assume sunlight would cast long shadows. Because the shadows look short, the date and time
might not be accurate. In addition, if latitude and longitude values are available in the Exif file,
you could approximate the time of day based on the length and angle of shadows to the sun.
Of course, this calculation applies only to photos taken outside on sunny days.
Understanding Data Compression
Most graphics file formats, including GIF and JPEG, compress data to save disk space and
reduce the file’s transmission time. Other formats, such as BMP, rarely compress data or do
so inefficiently. In this case, you can use compression tools to compact data and reduce file
size. Data compression is the process of coding data from a larger form to a smaller form.
Graphics files and most compression tools use one of two data compression schemes: lossless
or lossy. You need to understand how compression schemes work to know what happens
when an image is altered.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Locating and Recovering Graphics Files
325
Lossless and Lossy Compression
This section describes how lossless and lossy compression work, explains their advantages
and disadvantages, and discusses what they mean in terms of digital forensics.
Lossless compression techniques reduce file size without removing data. When you uncompress a file that uses lossless compression, you restore all its information. GIF and Portable
Network Graphics (PNG) file formats reduce file size with lossless compression, which saves
file space by using mathematical formulas to represent data in a file. These formulas generally
use one of two algorithms: Huffman or Lempel-Ziv-Welch (LZW) coding. Each algorithm
uses a code to represent redundant bits of data. For example, if a graphics file contains a large
red area, the algorithm can set 1 byte to red and set another byte to specify 200 red bytes
instead of having to store 200 red bytes. Therefore, only 2 bytes are used.
Lossy compression is much different because it compresses data by permanently discarding bits
of information in the file. Some discarded bits are redundant, but others are not. When you
uncompress a graphics file that uses lossy compression, you lose information, although most people don’t notice the difference unless they print the image on a high-resolution printer or increase
the image size. In either case, the removed bits of information reduce image quality. The JPEG format is one that uses lossy compression. If you open a JPEG file in a graphics program, for example, and save it as a JPEG file with a different name, lossy compression is reapplied automatically,
which removes more bits of data and, therefore, reduces image quality. If you simply rename a file
by using File Explorer or the command line, however, the file doesn’t lose any more data.
Another form of lossy compression, vector quantization (VQ), uses complex algorithms to
determine what data to discard based on vectors in the graphics file. In simple terms, VQ discards bits in much the same way rounding off decimal values discards numbers.
Some widely used lossless compression utilities include WinZip, PKZip, Stufflt, and FreeZip.
Lzip is a lossy compression utility. You use compression tools to compact folders and files for
data storage and transmission. Remember that the difference between lossless and lossy compression is the way data is represented after it has been uncompressed. Lossless compression
produces an exact replica of the original data after it has been uncompressed; lossy compression typically produces an altered replica of the data.
Locating and Recovering Graphics Files
In a digital forensics investigation involving graphics files, you need to locate and recover all
graphics files on the suspect drive and determine which ones are pertinent to your case.
Because images aren’t always stored in standard graphics file formats, you should examine
all files your forensics tools find, even if they aren’t identified as graphics files.
Some OSs have built-in tools for recovering graphics files, but they’re time consuming, and
the results are difficult to verify. Instead, you can use digital forensics tools dedicated to analyzing graphics files. As you work with these tools and built-in OS tools, develop standard
procedures for your organization and continue to refine them so that other investigators can
benefit from your experience. You should also follow standard procedures for each case to
make sure your analysis is thorough.
As discussed earlier in “Examining the Exchangeable Image File Format,” you can use digital
forensics tools to analyze images based on information in graphics files. Each graphics file
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
8
326
Chapter 8
contains a header with instructions for displaying the image; this header information helps
you identify the file format. The header is complex and difficult to remember, however;
instead of memorizing header information, you can compare a known good file header with
that of a suspected file. For example, if you find an image that you suspect is a JPEG file but
can’t display it with a bitmap graphics program, compare its file header with a known JPEG
file header to determine whether the header has been altered. You could then use the information in the known JPEG file header to supply instructions for displaying the image. In other
words, you use the known JPEG header information to create a baseline analysis.
Before you can examine a graphics file header, often you need to reconstruct a fragmented
graphics file. To do so, you need to identify the data patterns the graphics file uses. If part of
the file header has been overwritten with other data, you might also need to repair the damaged header. By rebuilding the file header, you can then perform a forensics analysis on the
graphics file. These techniques are described in the following sections.
Identifying Graphics File Fragments
If a graphics file is fragmented across areas on a disk, you must recover all the fragments before
re-creating the file. Recovering any type of file fragments is called carving, also known as
salvaging outside North America. To carve a graphics file’s data from file slack space and free
space, you should be familiar with the data patterns of known graphics file types. Many digital
forensics programs, such as ProDiscover, X-Ways Forensics, OS Forensics, EnCase, and FTK,
can recognize these data patterns and carve the graphics files from slack and free space automatically, however. After you recover fragments of a graphics file, you restore them to continue your
examination. You use ProDiscover Basic and WinHex later in this chapter to copy known data
patterns from files you recover, and then restore this information to view the graphics file.
Repairing Damaged Headers
When you’re examining recovered fragments from files in slack or free space, you might find data
that appears to be a header for a common graphics file type. If you locate header data that’s partially overwritten, you must reconstruct the header to make it readable by comparing the hexadecimal values of known graphics file formats with the pattern of the file header you found.
Each graphics file type has a unique header value. As you become familiar with these header
values, you can spot data from partially overwritten headers in file slack or free space. For
example, a JPEG file has the hexadecimal header value FFD8, followed by the label JFIF for a
standard JPEG or Exif file at offset 6.
Suppose you’re investigating a possible intellectual property theft by a contract employee of
Exotic Mountain Tour Service (EMTS). EMTS has just finished an expensive marketing and customer service analysis with Superior Bicycles, LLC. Based on this analysis, EMTS plans to release
advertising for its latest tour service with a joint product marketing campaign with Superior
Bicycles. Unfortunately, EMTS suspects that a contract travel consultant, Bob Aspen, might have
given sensitive marketing data to another bicycle competitor. EMTS is under a nondisclosure
agreement with Superior Bicycles and must protect this advertising campaign material.
An EMTS manager found a USB drive on the desk Bob Aspen was assigned to. Your task is
to determine whether the drive contains proprietary EMTS or Superior Bicycles data. The
EMTS manager also gives you some interesting information he gathered from the Web
server administrator. EMTS filters all Web-based e-mail traffic traveling through its network
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Locating and Recovering Graphics Files
327
and detects suspicious attachments. When a Web-based e-mail with attachments is received,
the Web filter is triggered. The EMTS manager gives you two screen captures, shown in
Figures 8-5 and 8-6, of partial e-mails intercepted by the Web filter that lead him to believe
Bob Aspen might have engaged in questionable activities.
Figure 8-5 First intercepted capture of an e-mail from Terry Sadler
ª 2016 Cengage Learningâ
Figure 8-6 Second intercepted capture of an e-mail from denisesuperbic@hotmail.com
ª 2016 Cengage Learningâ
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
8
328
Chapter 8
For this examination, you need to search for all possible places data might be hiding. To do
this, in the next section you use ProDiscover’s cluster search function with hexadecimal
search strings to look for known data.
Searching for and Carving Data from Unallocated Space
At this time, you have little information on what to look for on the USB drive Bob Aspen
used. You need to ask some basic questions and make some assumptions based on available
information to proceed in your search for information.
The first message from terrysadler@goowy.com is addressed to baspen99@aol.com, which
matches the contract employee’s name, Bob Aspen. Next, look at the time and date stamps in
this message. The first is 4 Feb 2015 9:21 PM, and the second, farther down, is a header from
Jim Shu with a time and date stamp of February 5, 2015, 5:17 AM -08:00.
Therefore, it seems Jim Shu sent the original message, which was forwarded to the
terrysadler@goowy.com account. Because the timestamp for Jim Shu is later than the timestamp for terrysadler@goowy.com, Terry Sadler’s location might be in a different time
zone, somewhere west of Jim Shu, or one of the two e-mail server’s time values is off
because e-mail servers, not users, provide timestamps. In Chapter 11, you learn more about
e-mail header information.
Continuing with the first message, note that Jim is telling Terry to have Bob alter the file
extensions from .txt to .jpg, and the files are about new kayaks. The last line appears to
be a previous response from terrysadler@goowy.com commenting that Bob (assuming it’s
Bob Aspen) can’t receive this message.
So far, you have the following facts:
•
Jim Shu’s e-mail refers to JPEG files.
•
Jim Shu’s attached JPEG files need to have the extension renamed from .txt to .jpg.
•
Jim Shu’s attachments might be photographs of new kayaks.
•
The e-mail account names in this message are terrysadler@goowy.com,
baspen99@aol.com, and jim_shu1@yahoo.com.
Now examine the second e-mail, which contains the following pieces of information:
•
Jim Shu had a tour of the new kayak factory.
•
Another party might be interested in competing in manufacturing kayaks.
•
Jim Shu smuggled out JPEG photos he modified with a hexadecimal editor so that they
wouldn’t be detected by any Web or e-mail filters.
•
Jim Shu provides instructions on how to reedit the digital photos and add the .jpeg
extension so that they can be viewed.
•
Jim Shu thinks Bob Aspen is working at EMTS.
•
Jim Shu sent a copy (CC) to nautieriko@lycos.com.
With these collected facts and your knowledge of JPEG file structures, you can use the steps
in the following sections to determine whether these allegations are true.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Locating and Recovering Graphics Files
329
Planning Your Examination In the second e-mail from Jim Shu to Terry Sadler,
Jim states, “So to view them you have to re-edit each file to the proper JPEG header of
offset 0x FF D8 FF E0 and offset 6 of 4A.” From this statement, you can assume that
any kayak photographs on the USB drive contain unknown characters in the first four bytes
and the sixth byte. Because this is all Jim Shu said about the JPEG files, you need to
assume that the seventh, eighth, and ninth bytes have the original correct information for the
JPEG file.
In “Examining the Exchangeable Image File Format,” you learned the difference between a
standard JFIF JPEG and an Exif JPEG file: The JFIF format has 0x FFD8 FFE0 in the first
four bytes, and the Exif format has 0x FFD8 FFE1. In the sixth byte, the JPEG label is listed
as JFIF or Exif. In the second e-mail, Jim Shu mentions 0x FF D8 FF E0, which is a JFIF JPEG
format. He also says to change the sixth byte to 0x 4A, which is the uppercase letter “J” in
ASCII.
Because the files might have been downloaded to the USB drive, Bob Aspen could have
altered or deleted them, so you should be thorough in your examination and analysis. You
need to search all sectors of the drive for deleted files, both allocated space (in case Bob didn’t
modify the files) and unallocated space. In the next section, you use ProDiscover to search for
and recover these JPEG files.
Searching for and Recovering Digital Photograph Evidence In this
section, you learn how to use ProDiscover to search for and extract (recover) possible evidence of JPEG files from the USB drive the EMTS manager gave you. The search string to use
for this examination is “FIF.” Because it’s part of the label name of the JFIF JPEG format,
you might have several false hits if the USB drive contains several other JPEG files. These false
hits, referred to as false positives, require examining each search hit to verify whether it’s
what you are looking for.
The image file of the USB drive is included on the book’s DVD. You should extract all files in
the Chap08 folder on the DVD to your C:nWorknChap08nChapter folder (referred to as
your “work folder” in steps). Create this folder on your system first, if necessary.
Remember that the work folder you create most likely has a different
name from what’s shown in screenshots.
To begin the examination, follow these steps to load the image file:
1. Start ProDiscover Basic (with the Run as administrator option, if necessary), and click
the New Project toolbar button. In the New Project dialog box, type C08InChp for
the project number and filename, and then click OK.
2. Click Action from the menu, point to Add, and click Image File.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
8
330
Chapter 8
3. In the Open dialog box, navigate to your work folder, click C08InChp.dd, and then
click Open.
4. To begin a search, click the Search toolbar button or click Action, Search from the
menu to open the Search dialog box.
5. Click the Cluster Search tab, and then click the Case Sensitive check box.
Under Search for the pattern(s), type FIF (see Figure 8-7). Under Select the
Disk(s)/Image(s) you want to search in, click the C08InChp.dd file, and then
click OK.
Figure 8-7 Searching clusters in ProDiscover
Courtesy of Technology Pathways, LLC
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Locating and Recovering Graphics Files
331
6. When the search is done, click the search hit, AC4(2756), to display the cluster’s
content (see Figure 8-8).
8
Figure 8-8 Completed cluster search for FIF
Courtesy of Technology Pathways, LLC
In Figure 8-9, the header for this JPEG file has been overwritten with
zzzz. This unique header information might give you additional
search values that could minimize false-positive hits in subsequent
searches.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
332
Chapter 8
File header overwritten with zzzz
Figure 8-9 Content of cluster AC4(2756)
Courtesy of Technology Pathways, LLC
7. Next, locate the file by right-clicking cluster number AC4(2756) and clicking Find
File, and then click Yes in the warning message.
8. In the List of Clusters dialog box, click Show File (see Figure 8-10), and then click
Close.
Figure 8-10 Viewing all clusters used by the gametour4.exe file
Courtesy of Technology Pathways, LLC
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Locating and Recovering Graphics Files
333
9. In the work area, right-click the gametour4.exe file (see Figure 8-11) and
click Copy File. In the Save As dialog box, navigate to your work folder, type
Recover1.jpg for the filename, and then click Save.
8
Figure 8-11 Mislabeled file that appears to be altered intentionally
Courtesy of Technology Pathways, LLC
10. Click File, Exit from the menu, and then click Yes and Save to save this project in
your work folder.
In WinHex Demo, you can save only up to 200 KB of data in a file.
That’s why for activities in this book involving data extractions larger
than 200 KB, ProDiscover Basic or OS Forensics is used.
The next section shows you how to rebuild header data from this recovered file by
using WinHex, although any hexadecimal editor has the capability to examine and repair
damaged file headers. From a digital forensics view, this procedure can be considered corrupting the evidence, but knowing how to reconstruct data, as in the preceding example,
is part of an investigator’s job. When you change data as part of the recovery and analysis process, make sure you document each step as part of your reporting procedures.
Your documentation should be detailed enough that other investigators could repeat the
steps, which increases the credibility of your findings. When you’re rebuilding a corrupted
evidence image file, create a new file and leave the original file in its initial corrupt
condition.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
334
Chapter 8
Rebuilding File Headers
Before attempting to edit a graphics file you have recovered, try to open it with an image
viewer, such as the default Microsoft tool. To test whether you can view the image, doubleclick the recovered file in its current location in File Explorer. If you can open and view the
image, you have recovered the graphics file successfully. If the image isn’t displayed, you have
to inspect and correct the header values manually.
If some of the data you recovered from the graphics file header is corrupt, you might need to
recover more pieces of the file before you can view the image, as you’ll see in the next section.
Because the deleted file you recovered in the previous activity, Recoverl.jpg, was altered
intentionally, you might see an error message similar to the one in Figure 8-12 when you
attempt to open the file.
Figure 8-12 Error message indicating a damaged or an altered graphics file
Courtesy of Microsoft Corporation
If you can’t open a graphics file in an image viewer, the next step is to examine the file’s
header data to see whether it matches the header in a good JPEG file. If the header doesn’t
match, you must insert the correct hexadecimal values manually with a hexadecimal editor.
To inspect a file with WinHex, follow these steps:
1. Start WinHex, and click File, Open from the menu. Navigate to your work
folder, and then double-click Recover1.jpg. Figure 8-13 shows this file open
in WinHex.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Locating and Recovering Graphics Files
Offset position 0
335
Offset position 6
8
Figure 8-13 Recover1.jpg open in WinHex
Courtesy of X-Ways AG, www.x-ways.net
2. At the top of the WinHex window, notice that the hexadecimal values starting at the
first byte position (offset 0) are 7A 7A 7A 7A, and the sixth position (offset 6) is also
7A. Leave WinHex open for the next activity.
As mentioned, a standard JFIF JPEG file has a header value of FF D8 FF E0 from offset 0
and the label name JFIF starting at offset 6. Using WinHex, you can correct this file header
manually by following these steps:
1. In the center pane, click to the left of the first 7A hexadecimal value. Then type
FF D8 FF E0, which are the correct hexadecimal values for the first 4 bytes of
a JPEG file.
2. In the right pane at offset 6, click the z, and then type J, as shown in Figure 8-14.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
336
Chapter 8
Insert FF D8 FF E0 starting at offset 0
Insert an uppercase J here
Figure 8-14 Inserting correct hexadecimal values for a JPEG file
Courtesy of X-Ways AG, www.x-ways.net
In WinHex, when you type a keyboard character in the right pane, the
corresponding hexadecimal value appears in the center pane. So, for
example, when you type J in the right pane, the hexadecimal value
4A appears in the center pane.
3. Click File, Save As from the menu. In the Save File As dialog box, navigate
to your work folder, type Fixed1.jpg as the filename, and then click Save.
Exit WinHex.
Every two hexadecimal values you entered in the previous steps are equivalent to one ASCII
character. For example, an uppercase “A” has the hexadecimal value 41, and a lowercase
“a” has the hexadecimal value 61. Most disk editors have a reference chart for converting
hexadecimal values to ASCII characters, such as in Figure 8-15.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Locating and Recovering Graphics Files
337
Figure 8-15 ASCII equivalents of hexadecimal values
ª Cengage Learningâ
After you repair a graphics file header, you can test the updated file by opening it in an image
viewer, such as Windows Photo Viewer, IrfanView, ThumbsPlus, Quick View, or ACDSee. If
the file displays the image, as shown in Figure 8-16, you have performed the recovery correctly.
8
Figure 8-16 Fixed1.jpg open in an image viewer
ª 2016 Cengage Learningâ
The process of repairing file headers isn’t limited to JPEG files. You can apply the same technique to any file you can determine the header value for, including Microsoft Word, Excel,
and PowerPoint documents and other image formats. You need to know only the correct
header format for the type of file you’re attempting to repair.
Reconstructing File Fragments
You might occasionally encounter corrupt data that prevents you from recovering data fragments for files. Whether the data corruption is accidental or intentional, you need to know
how to examine a suspect drive and extract possible data fragments to reconstruct files for
evidentiary purposes. In this section, you learn how to locate noncontiguous clusters that
make up a deleted file. Current digital forensics tools can typically follow the links between
clusters for FAT and NTFS file systems. However, sometimes the pointer information in a
FAT or an NTFS Master File Table (MFT) file doesn’t list this information.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
338
Chapter 8
The JPEG file you recovered in the previous activity was fragmented into several clusters. The
following activity shows you how to recover a fragmented graphics file on a suspect drive. To
perform this data-carving task, you need to locate the starting and ending clusters for each
fragmented group of clusters. Here’s an overview of the procedure:
1. Locate and export all clusters of the fragmented file.
2. Determine the starting and ending cluster numbers for each fragmented group of
clusters.
3. Copy each fragmented group of clusters in their correct sequence to a recovery file.
4. Rebuild the file’s header to make it readable in a graphics viewer.
Use the project you created previously, C08InChp, to analyze the fragmentation:
1. Start ProDiscover Basic (with the Run as administrator option, if necessary). Click File,
Open Project from the menu, navigate to your work folder, click the C08InChp.dft
file you saved previously when you exited ProDiscover, and then click Open.
2. In the tree view, click Cluster Search Results, and then in the work area, click
AC4(2756). Right-click the cluster row AC4(2756) and click Find File. When
prompted, click Yes in the Continue search message box.
3. In the List of Clusters dialog box, click Copy to Clipboard. Start Notepad, paste the
cluster into a new document, and save the file as AC4-carve.txt in your work
folder. Leave Notepad open for the following steps.
4. In ProDiscover’s List of Clusters dialog box, click Close.
5. In the tree view, click to expand Cluster View, if necessary, click to expand Images,
and then click the C08InChp.dd image file to view the cluster (Figure 8-17).
Figure 8-17 Cluster view of C08InChp.dd
Courtesy of Technology Pathways, LLC
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Locating and Recovering Graphics Files
339
6. Examine the AC4-carve.txt file in Notepad to determine the clusters that are grouped
together and see the range for each cluster group. For example, locate the first cluster
number, AC4, and count downward until you find a cluster number that’s not sequential.
Make note of the last contiguous cluster number before the change to determine the first
cluster group for this fragmented file. Continue through the list of cluster numbers to
determine all fragments. The following list shows the cluster groups you should find:
•
Fragment range 1—AC4 to B20
•
Fragment range 2—1D6 to 229
•
Fragment range 3—3CC to 406
•
Fragment range 4—14B to 182
•
Fragment range 5—938 to 96D
•
Fragment range 6—6 to D
The first fragment starts at hexadecimal AC4 (decimal 2756) and continues to hexadecimal B29. The next fragment starts at 1D6 and
continues to 229, and so on until the last segment of fragmented
clusters. This file is very fragmented.
7. In ProDiscover’s tree view, click Cluster View, Images, and the C08InChp.dd
file, if necessary. In the work area’s Cluster text box at the lower right, type AC4
(see Figure 8-18) and click Go.
Figure 8-18 Cluster view of sector AC4
Courtesy of Technology Pathways, LLC
To view all cluster columns in the work area, as shown in Figures 8-18
and 8-19, you need to maximize ProDiscover Basic’s view and increase
the work area’s size. Drag its left border to the left, into the tree view,
until you can see all 30 hexadecimal columns, and then release the
mouse button.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
8
340
Chapter 8
8. In the work area, click cluster AC4 and drag to the right until you’ve highlighted all
clusters to B20 (see Figure 8-19).
Selected blocks from AC4 to B20
Cluster text box
Figure 8-19 Selecting blocks from cluster AC4 to B20
Courtesy of Technology Pathways, LLC
9. Right-click the highlighted blocks (clusters) in the work area and click Select.
In the Add Comment dialog box, click the Apply to all items check box.
In the Investigator comments text box, type Fragment 1 to recover, and then
click OK.
10. Repeat Steps 7 through 9 to select the remaining fragmented blocks for
these sectors: 1D6 to 229, 3CC to 406, 14B to 182, 938 to 96D, and
6 to D. In the Add Comment dialog box, increase the comment’s fragment
number by 1 for each block: Fragment 2 to recover, Fragment 3 to recover,
and so on.
11. After all clusters have been selected, click Tools, point to Copy Evidence of Interest,
and click Copy All Selected Clusters from the menu.
12. In the Recover Clusters dialog box, click the Recover all clusters to a single
file option button and the Recover Binary check box (see Figure 8-20).
Click Browse, navigate to and click your work folder, and then click OK.
Click OK again.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Identifying Unknown File Formats
341
Figure 8-20 Copying all selected clusters
to a file
Courtesy of Technology Pathways, LLC
13. Exit ProDiscover Basic, saving this project in your work folder if prompted.
Exit Notepad, saving the file if prompted. The next step would be rebuilding the
header of this recovered file, as you did in a previous activity.
When you copy the selected data with ProDiscover’s Recover Clusters function, a file named
C08InChp-00000000-00000353.txt is created. ProDiscover adds a .txt extension automatically on all copied clusters the Recover Clusters function exports. To view and rebuild
this file, you would use the techniques described previously in “Rebuilding File Headers.”
(Remember to save the updated recovered data with a .jpg extension.) You would notice
that it’s the same data that enabled you to re-create Fixed1.jpg. Other JPEG files, such as
gametour4.exe, can be recovered by using the same techniques. Because gametour4.exe
is larger than 200 KB, you would have to extract its data into two separate files if you were
using WinHex. Next, you would repair the first file containing the overwritten data of zzzz,
such as fragment1.txt, and then combine the two files into one file. To combine them, you
can use the DOS command type fragment2.txt >> fragment1.txt, and then use the
DOS command ren to rename fragment1.txt as Fixed2.jpg. Another disk editor you
can use is Hex Workshop (www.hexworkshop.com), which has a 30-day use policy for a demo
version and no file size limits.
Identifying Unknown File Formats
With the continuing changes in technology and digital graphics, eventually you’ll encounter
graphics file formats you’re not familiar with. In addition, suspects might use older systems
with programs that create files in uncommon or obsolete file formats. Therefore, you must
research both old and new file types. Knowing the purpose of each format and how it stores
data is part of the investigation process.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
8
342
Chapter 8
The Internet is the best source for learning more about file formats and their extensions. You
have already used the Webopedia site to research the TGA file format. You can also use a
search engine to search for “file type” or “file format” and find the latest list of Web sites
with information on file extensions. If you still can’t find a specific file extension, try refining
your search by entering the file extension along with the words “file format” in a search
engine. One nonstandard graphics file format is XIF. To search for information on this file
format, follow these steps:
1. Start your Web browser, and go to www.google.com.
2. Type XIF file format in the text box and press Enter.
3. Click a few links in the search results to learn more about this file format. When you’re
finished, exit your Web browser.
Nuance PaperPort is a scanning program that produces images in the XIF (also referred
to as XIFF) format, which is derived from the TIF file format. (It’s not related to the Exif
format.) Older versions of PaperPort had a free viewer utility for XIF files, but you can
also use Solvusoft FileViewPro (www.solvusoft.com/en/file-extensions/file-extension-xif/) to
view these files.
The following sites have information to help you analyze file formats. Keep in mind that
information on the Web changes frequently; use a search engine to find graphics file information if you can’t access these Web sites:
•
www.fileformat.info/format/all.htm
•
http://extension.informer.com/
•
www.martinreddy.net/gfx/
Analyzing Graphics File Headers
You should analyze graphics file headers when you find new or unique file types that forensics tools don’t recognize. The simplest way to access a file header is to use a hexadecimal
editor, such as WinHex. You can then record the hexadecimal values in the header and use
them to define a file type.
For example, suppose you encounter an XIF file. Because this format is so old, not much
information on it is available. If you need to look for hidden or deleted XIF files, you must
build your own header search string. To do this, you need a hexadecimal editor, such as
WinHex. To see the differences between XIF and TIF, viewing and comparing header values
for these file formats is good practice.
TIF is a well-established file format for transmitting faxes and for use in printed publications.
All TIF files start at offset 0 with hexadecimal 49 49 2A. These hexadecimal values translate
to the letters “II” in ASCII. Figure 8-21 shows a sample TIF file open in WinHex.
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Identifying Unknown File Formats
343
TIF file headers start with hexadecimal 49 49 2A, equivalent to ASCII II
Figure 8-21 A TIF file open in WinHex
Courtesy of X-Ways AG, www.x-ways.net
The first 3 bytes of an XIF file are the same as a TIF file, followed by other hexadecimal values that distinguish it from a TIF file (see Figure 8-22). As you can see, the XIF header starts
with hexadecimal 49 49 2A and has an offset of 4 bytes of 5C 01 00 00 20 65 58 74 65 6E
64 65 64 20 03. (Some values have been cut off in this figure to conserve space.) With this
information, you can configure your forensics tool to detect an XIF file header. For more
information on XIF, go to www.fileformat.info/info/mimetype/image/vnd.xiff/index.htm or
www.vincent-net.com/luc/papers/99isdm document talk.pdf.
XIF file header
ASCII equivalent shows the same beginning values as a TIF extension
Figure 8-22 An XIF file open in WinHex
Courtesy of X-Ways AG, www.x-ways.net
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
8
344
Chapter 8
Tools for Viewing Images
Throughout this chapter, you have been learning about recognizing file formats, using compression techniques, salvaging header information, recovering graphics files, and saving your
modifications. After you recover a graphics file, you can use an image viewer to open and
view it. Several hundred image viewers are available that can read many graphics file formats,
although no one viewer program can read every file format. Therefore, having many different
viewer programs for investigations is best.
Many viewer utilities are freeware or shareware programs that can be used to view a wide
range of graphics file formats. Most GUI forensics tools include image viewers that
display only common image formats, especially GIF and JPEG, which are often found in
Internet-related investigations. For less common file formats, such as PCX, integrated viewers
often simply identify the data as a graphics file or might not recognize the data at all. Being
unable to view all formats can prevent you from finding critical evidence for a case. Be sure
that you analyze, identify, and inspect every unknown file on a drive.
With many forensics tools, you can open files with external viewers.
Understanding Steganography in Graphics Files
When you open some graphics files in an image viewer, they might not seem to
contain information related to your investigation. However, someone might have hidden
information inside the image by using a data-hiding technique called steganography (discussed in more detail in Chapter 9), which uses a host file to cover the contents of a
secret message.
Steganography has been used since ancient times. Greek rulers used this technique to
send covert messages to diplomats and troops via messengers. To hide messages, rulers
shaved their messengers’ heads and tattooed messages on their scalps. After the messengers’ hair grew enough to cover the message, they left for their destinations, where they
shaved their heads so that recipients could read the message. This method was a clever
way to send and retrieve encrypted information, but it was inefficient because the messengers’ hair took a long time to grow back, and only a limited amount of space was
available to write messages. However, it enabled the Greeks to send secret messages
until their enemies discovered this early form of steganography and began intercepting
messengers.
Contemporary steganography has limits because a graphics file can
hide only a certain amount of information before its size and structure
change. However, it does allow someone to send covert information
to a recipient, unless someone else detects the hidden data.
The two major forms of steganography are insertion and substitution. Insertion places data
from the secret file into the host file. When you view the host file in its associated program, the
inserted data is hidden unless you analyze the data structure carefully. For example, if you create a Web page with HTML, you can display images and text in a Web browser without
Copyright 2016 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Identifying Unknown File Formats
345
revealing the HTML code. Figure 8-23 shows a typical Web page intended to